CVE-2022-41655: Exposure of Sensitive Information to an Unauthorized Actor

Auth. subscriber+ Sensitive Data Exposure vulnerability in Phone Orders for WooCommerce plugin = 3.7.1 on WordPress...

CVE-2022-41609: Server-Side Request Forgery (SSRF)

Auth. subscriber+ Server-Side Request Forgery SSRF vulnerability in Better Messages plugin 1.9.10.68 on WordPress...

CVE-2022-40130: Concurrent Execution using Shared Resource with Improper Synchronization

Auth. subscriber+ Race Condition vulnerability in WP-Polls plugin = 2.76.0 on WordPress...

CVE-2022-40698: Improper Neutralization of Input During Web Page Generation

Auth. subscriber+ Cross-Site Scripting XSS vulnerability in Quiz And Survey Master plugin = 7.3.10 on WordPress...

CVE-2022-45369: Undefined Security Weakness

Auth. subscriber+ Broken Access Control vulnerability in Plugin for Google Reviews plugin = 2.2.2 on WordPress...

PT-2022-25479

Name of the Vulnerable Software and Affected Versions Quiz And Survey Master plugin versions = 7.3.10 Description The issue is related to an Authenticated Cross-Site Scripting XSS vulnerability. This means that an attacker who has subscriber-level access or higher can inject malicious scripts int...

CVE-2022-45077: Deserialization of Untrusted Data

Auth. subscriber+ PHP Object Injection vulnerability in Betheme theme = 26.5.1.4 on WordPress...

CVE-2022-45066: Undefined Security Weakness

Auth. subscriber+ Broken Access Control vulnerability in WooSwipe WooCommerce Gallery plugin = 2.0.1 on WordPress...

CVE-2022-2450: Missing Authorization

The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 lacks authorization in various AJAX actions, allowing any logged-in users, such as subscribers to call them...

CVE-2022-41978: Undefined Security Weakness

Auth. subscriber+ Arbitrary Options Update vulnerability in Zoho CRM Lead Magnet plugin = 1.7.5.8 on WordPress...

CVE-2022-40205: Authorization Bypass Through User-Controlled Key

Insecure direct object references IDOR vulnerability in the wpForo Forum plugin = 2.0.5 on WordPress allows attackers with subscriber or higher user roles to mark any forum post as solved/unsolved...

CVE-2022-44795: Use of Insufficiently Random Values

An issue was discovered in Object First Ootbi BETA build 1.0.7.712. A flaw was found in the Web Service, which could lead to local information disclosure. The command that creates the URL for the support bundle uses an insecure RNG. That can lead to prediction of the generated URL. As a result, a...

CVE-2022-3536: Deserialization of Untrusted Data

The Role Based Pricing for WooCommerce WordPress plugin before 1.6.3 does not have authorisation and proper CSRF checks, as well as does not validate path given via user input, allowing any authenticated users like subscriber to perform PHAR deserialization attacks when they can upload a file, an...

CVE-2022-3400: Missing Authorization

The Bricks theme for WordPress is vulnerable to authorization bypass due to a missing capability check on the brickssavepost AJAX action in versions 1.0 to 1.5.3. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to edit any page, post, or template...

CVE-2022-3401: Undefined Security Weakness

The Bricks theme for WordPress is vulnerable to remote code execution due to the theme allowing site editors to include executable code blocks in website content in versions 1.2 to 1.5.3. This, combined with the missing authorization vulnerability CVE-2022-3400, makes it possible for authenticate...

CVE-2022-3247: Server-Side Request Forgery (SSRF)

The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.9.10 does not have authorisation in an AJAX action, and does not ensure that the URL to make a request to is an external one. As a result, any authenticated users, such as subscriber could perform SSRF attacks...

CVE-2022-38070: Undefined Security Weakness

Privilege Escalation subscriber+ vulnerability in Pop-up plugin = 1.1.5 at WordPress...

CVE-2022-37244: Improper Neutralization of Input During Web Page Generation

MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to IFRAME Injectionvia the currentRequest parameter. after login leads to inject malicious tag leads to IFRAME injection...

CVE-2022-36341: Improper Neutralization of Input During Web Page Generation

Authenticated subscriber+ plugin settings change leading to Stored Cross-Site Scripting XSS vulnerability in Akash soni's AS – Create Pinterest Pinboard Pages plugin = 1.0 at WordPress...

CVE-2022-33142: Uncontrolled Resource Consumption

Authenticated subscriber+ Denial Of Service DoS vulnerability in WordPlus WordPress Better Messages plugin = 1.9.10.57 at WordPress...