CVE-2025-2267: Missing Authorization

The WP01 plugin for WordPress is vulnerable to Arbitrary File Download in all versions up to, and including, 2.6.2 due to a missing capability check and insufficient restrictions on the makearchive function. This makes it possible for authenticated attackers, with Subscriber-level access and abov...

PT-2025-11316

Name of the Vulnerable Software and Affected Versions: The WC Affiliate – A Complete WooCommerce Affiliate Plugin versions up to, and including, 2.5.3 Description: The issue allows unauthorized access to data due to a missing capability check on the export all data function. This makes it possibl...

PT-2025-11314

Name of the Vulnerable Software and Affected Versions uListing plugin for WordPress versions up to, and including, 2.1.7 Description The uListing plugin for WordPress is vulnerable to Privilege Escalation due to the stm listing profile edit AJAX action not having enough restriction on the user me...

CVE-2025-1653: Incorrect Privilege Assignment

The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.2.0. This is due to the stmlistingprofileedit AJAX action not having enough restriction on the user meta that can be updated. This makes it possibl...

CVE-2025-1657: Missing Authorization

The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to unauthorized modification of data and PHP Object Injection due to a missing capability check on the stmlistingajax AJAX action in all versions up to, and including, 2.2.0. This makes it possible for...

PT-2025-11315

Name of the Vulnerable Software and Affected Versions: uListing plugin for WordPress versions up to, and including, 2.1.7 Description: The issue is related to a missing capability check on the stm listing ajax AJAX action, allowing authenticated attackers with subscriber-level access and above to...

CVE-2024-12336: Missing Authorization

The WC Affiliate – A Complete WooCommerce Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'exportalldata' function in all versions up to, and including, 2.5.3. This makes it possible for authenticated attackers, with...

CVE-2025-2289

The Zegen - Church WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX endpoints in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to impor...

CVE-2025-0952

CVE-2025-0952 affects the Eco Nature - Environment & Ecology WordPress Theme. A missing capability check on the cmsmasters_hide_admin_notice AJAX action in all versions up to 2.0.4 allows authenticated users with Subscriber+ access to modify options (e.g., setting hide) and potentially cause a de...

PT-2025-11246

Name of the Vulnerable Software and Affected Versions: The Zegen - Church WordPress Theme versions prior to 1.1.9 Description: The issue is related to unauthorized access due to a missing capability check on several AJAX endpoints. This allows authenticated attackers with Subscriber-level access...

PT-2025-11241

Name of the Vulnerable Software and Affected Versions Industrial theme for WordPress versions up to, and including, 1.7.8 Description The Industrial theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on th...

CVE-2025-2289: Missing Authorization

The Zegen - Church WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX endpoints in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to impor...

PT-2025-11245

Name of the Vulnerable Software and Affected Versions: SoundRise Music plugin for WordPress versions up to, and including, 1.6.11 Description: The issue allows unauthorized modification of data, potentially leading to privilege escalation, due to a missing capability check on the theirMusic ajax...

CVE-2024-12810: Missing Authorization

The JobCareer | Job Board Responsive WordPress Theme theme for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability checks on multiple functions in all versions up to, and including, 7.1. This makes it possible for authenticated attackers, wit...

CVE-2024-13376: Improper Privilege Management

The Industrial theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the ajaxgettotalcontentimportitems function in all versions up to, and including, 1.7.8. This makes it possible for authenticated...

CVE-2025-1528: Missing Authorization

The Search & Filter Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getmetavalues' function in all versions up to, and including, 2.5.19. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

CVE-2025-0952: Missing Authorization

The Eco Nature - Environment & Ecology WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'cmsmastershideadminnotice' AJAX action in all versions up to, and including, 2.0.4. This mak...

CVE-2024-13703

The CRM and Lead Management by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcitaajaxtoggleae function in all versions up to, and including, 2.7.5. This makes it possible for authenticated attackers, with Subscriber-level...

PT-2025-10990

Name of the Vulnerable Software and Affected Versions: WP Crowdfunding plugin for WordPress versions up to, and including, 2.1.13 Description: The issue is related to a missing capability check on the download data action. This allows authenticated attackers with subscriber-level access and above...

CVE-2025-1508: Missing Authorization

The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the downloaddata action in all versions up to, and including, 2.1.14. This makes it possible for authenticated attackers, with subscriber-level access and above, to download...