PT-2025-1590 · WordPress · Fancypost

Name of the Vulnerable Software and Affected Versions: FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor plugin for WordPress versions up to, and including, 6.0.0 Description: The issue is related to unauthorized access of data due to a missing...

PT-2025-1817 · WordPress · Lazyload Background Images

Name of the Vulnerable Software and Affected Versions: LazyLoad Background Images plugin for WordPress versions up to and including 1.0.7 Description: The issue arises from a missing capability check on the pblzbg save settings function, allowing authenticated attackers with Subscriber-level acce...

WordPress FancyPost plugin <= 6.0.0 - Missing Authorization to Authenticated (Subscriber+) Shortcode Export vulnerability

Missing Authorization to Authenticated Subscriber+ Shortcode Export vulnerability discovered by Tieu Pham Trong Nhan in WordPress Plugin FancyPost versions = 6.0.0...

CVE-2024-12237 Photo Gallery Slideshow & Masonry Tiled Gallery <= 1.0.15 - Authenticated (Subscriber+) Limited Server-Side Request Forgery

The Photo Gallery Slideshow & Masonry Tiled Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.15 via the rjggetyoutubeinfojustifiedgallerycallback function. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2024-12237

CVE-2024-12237 affects the WordPress plugin Photo Gallery Slideshow & Masonry Tiled Gallery (WordPress, all versions up to 1.0.15). The vulnerability is a Server-Side Request Forgery in the rjg_get_youtube_info_justified_gallery_callback function, and requires an authenticated user with Subscribe...

CVE-2024-12132

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.4 due to missing validation on a user controlled key. This makes it possible for authenticated...

CVE-2024-12132

CVE-2024-12132 - WP Job Portal (WordPress) vulnerability : The WP Job Portal – A Complete Recruitment System plugin for WordPress is vulnerable to insecure direct object references in all versions up to 2.2.4 due to missing validation on a user-controlled key. This enables authenticated attackers...

CVE-2024-12132 WP Job Portal – A Complete Recruitment System for Company or Job Board website <= 2.2.4 - Authenticated (Subscriber+) Insecure Direct Object Reference

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.4 due to missing validation on a user controlled key. This makes it possible for authenticated...

PT-2025-1788 · WordPress · The Photo Gallery Slideshow & Masonry Tiled Gallery

Name of the Vulnerable Software and Affected Versions: The Photo Gallery Slideshow & Masonry Tiled Gallery plugin for WordPress versions up to, and including, 1.0.15 Description: The issue allows authenticated attackers with Subscriber-level access and above to make web requests to arbitrary...

PT-2025-1761 · WordPress · Wp Job Portal

Name of the Vulnerable Software and Affected Versions: WP Job Portal – A Complete Recruitment System plugin for WordPress versions up to, and including, 2.2.4 Description: The WP Job Portal plugin for WordPress is vulnerable to Insecure Direct Object Reference due to missing validation on a user...

CVE-2024-12238

The The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.8.22. This is due to the software allowing users to execute an action that does not properly validate a value before runni...

CVE-2024-12238

CVE-2024-12238 affects the WordPress plugin Ninja Forms – The Contact Form Builder That Grows With You. The vulnerability allows arbitrary shortcode execution in all versions up to and including 3.8.22 due to insufficient validation when do_shortcode is executed. This enables authenticated attack...

WordPress plugin Ninja Forms 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code injection...

PT-2024-17720 · WordPress · Wordpress File Upload

Name of the Vulnerable Software and Affected Versions: WordPress File Upload plugin versions up to, and including, 4.24.15 Description: The WordPress File Upload plugin is vulnerable to unauthorized access of data due to a missing capability check on the wfu ajax action read subfolders function...

CVE-2024-12032

The Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking plugin for WordPress is vulnerable to SQL Injection via the 'enquiryid' parameter of the 'tfenquiryreplyemailcallback' function in all versions up to, and including, 2.15.3 due to...

CVE-2024-12190

CVE-2024-12190 affects the WordPress plugin “Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder.” The vulnerability stems from a missing capability check on the bitform-form-entry-edit endpoint, present in all versions up to and...

PT-2024-17412 · WordPress · Tourfic – Ultimate Hotel Booking

Name of the Vulnerable Software and Affected Versions: Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin versions up to, and including, 2.15.3 Description: The issue is related to SQL Injection via the enquiry id parameter of the tf enquiry reply email callback...

WordPress Bit Form – Contact Form plugin <= 2.17.3 - Missing Authorization to Authenticated (Subscriber+) Form Submission Disclosure vulnerability

Missing Authorization to Authenticated Subscriber+ Form Submission Disclosure vulnerability discovered by Akbar Kustirama in WordPress Plugin Bit Form versions = 2.17.3...

CVE-2024-12594

CVE-2024-12594 concerns the WordPress plugin “Custom Login Page Styler” (ALL In One Custom Login Page family) where a missing capability check on AJAX action lps_generate_temp_access_url allows authenticated users with Subscriber+ privileges to impersonate other users. The CVE covers all versions...

PT-2024-17675 · WordPress · Wc Price History For Omnibus

Name of the Vulnerable Software and Affected Versions: WC Price History for Omnibus plugin for WordPress versions up to, and including, 2.1.3 Description: The issue is related to unauthorized access due to a missing capability check on several AJAX actions. This allows authenticated attackers wit...