CVE-2024-6120

CVE-2024-6120 affects the WordPress plugin Sparkle Demo Importer. Public details in connected docs confirm: all versions up to 1.4.7 are vulnerable due to a missing capability check in multiple functions, enabling authenticated attackers with Subscriber-level access (and above) to perform a destr...

WordPress Academy LMS Plugin <= 2.0.10 is vulnerable to Open Redirection

Software Academy LMS Type Plugin Vulnerable versions = 2.0.10 Fixed in 2.0.11 OWASP Top 10 A3: Injection Classification Open Redirection CVE CVE-2024-37234 Patch priority Low CVSS severity Low 3.5 Developer Claim ownership PSID 657d1fa47413 Credits Mochamad Sofyan Required privilege Subscriber...

WordPress Sparkle Demo Importer Plugin <= 1.4.7 is vulnerable to Broken Access Control

Software Sparkle Demo Importer Type Plugin Vulnerable versions = 1.4.7 Fixed in 1.4.8 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-6120 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 65191ad4a953 Credits Lucio Sá Required...

CVE-2024-3627

The Wheel of Life: Coaching and Assessment Tool for Life Coach plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on several functions in the AjaxFunctions.php file in all versions up to, and including, 1.1.7. This makes it possible...

CVE-2024-3602

The Pop ups, Exit intent popups, email popups, banners, bars, countdowns and cart savers – Promolayer plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the disconnectpromolayer function in all versions up to, and including, 1.1.0. This...

CVE-2023-3204

The Materialis theme for WordPress is vulnerable to limited arbitrary options updates in versions up to, and including, 1.1.24. This is due to missing authorization checks on the companiondisablepopup function called via an AJAX action. This makes it possible for authenticated attackers, with...

CVE-2024-3627

CVE-2024-3627 affects Wheel of Life: Coaching and Assessment Tool for Life Coach (WordPress). The WordPress plugin versions up to 1.1.7 are vulnerable due to missing authorization checks in AjaxFunctions.php, allowing authenticated attackers with subscriber-level access or higher to delete arbitr...

WordPress Ali2Woo Lite Plugin <= 3.3.5 is vulnerable to Broken Access Control

Software Ali2Woo Lite Type Plugin Vulnerable versions = 3.3.5 Fixed in 3.3.7 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-37210 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 02abd7b980c0 Credits Majed Refaea Required...

WordPress Ultimate Custom Add To Cart Button (Ajax) For WooCommerce by Binary Carpenter Plugin <= 1.222.16 is vulnerable to Broken Access Control

Software Ultimate Custom Add To Cart Button Ajax For WooCommerce by Binary Carpenter Type Plugin Vulnerable versions = 1.222.16 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-37202 Patch priority Medium CVSS severity Medium 6.5 Developer Clai...

WordPress WishList Member X Plugin < 3.26.7 is vulnerable to Privilege Escalation

Software WishList Member X Type Plugin Vulnerable versions 3.26.7 Fixed in 3.26.7 OWASP Top 10 A1: Broken Access Control Classification Privilege Escalation CVE CVE-2024-37107 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 853821d46a11 Credits Dave Jong Patchstack...

WordPress WP Scraper Plugin <= 5.7 is vulnerable to Server Side Request Forgery (SSRF)

Software WP Scraper Type Plugin Vulnerable versions = 5.7 Fixed in 5.8 OWASP Top 10 A10: Server-Side Request Forgery SSRF Classification Server Side Request Forgery SSRF CVE CVE-2024-37208 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID f83430a2f6b5 Credits Majed Refaea...

PT-2024-12291 · WordPress · Materialis

Name of the Vulnerable Software and Affected Versions: Materialis theme for WordPress versions up to, and including, 1.1.24 Description: The issue is due to missing authorization checks on the companion disable popup function called via an AJAX action. This allows authenticated attackers, with...

WordPress Popup box Plugin <= 4.5.1 is vulnerable to Broken Access Control

Software Popup box Type Plugin Vulnerable versions = 4.5.1 Fixed in 4.5.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-37096 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID aaf62ab75160 Credits Abdi Pranata Required privile...

PT-2024-26942 · WordPress · The Wheel Of Life: Coaching/Assessment Tool For Life Coach

Name of the Vulnerable Software and Affected Versions: The Wheel of Life: Coaching and Assessment Tool for Life Coach plugin for WordPress versions up to, and including, 1.1.7 Description: The issue is related to a missing capability check on several functions in the AjaxFunctions.php file. This...

WordPress User Rights Access Manager Plugin <= 1.1.2 is vulnerable to Broken Access Control

Software User Rights Access Manager Type Plugin Vulnerable versions = 1.1.2 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-37209 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 1f100e30e3b8 Credits Majed Refaea...

PT-2024-26848 · WordPress · Promolayer

Name of the Vulnerable Software and Affected Versions: Promolayer plugin for WordPress versions up to, and including, 1.1.0 Description: The Promolayer plugin for WordPress is affected by an issue that allows unauthorized updates to plugin settings. This is due to a missing capability check on th...

WordPress Demo Awesome Plugin <= 1.0.2 is vulnerable to Broken Access Control

Software Demo Awesome Type Plugin Vulnerable versions = 1.0.2 Fixed in 1.0.3 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-37207 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 678378443c06 Credits Abdi Pranata Required privilege...

Exploit for Improper Authentication in Elementor Website_Builder

CVE-2023-47504 POC Exploit for CVE-2023-47504. According to N...

CVE-2024-5768

The MIMO Woocommerce Order Tracking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mimoupdateprovider' function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2024-4450

The AliExpress Dropshipping with AliNext Lite plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the ImportAjaxController.php file in all versions up to, and including, 3.3.5. This makes it possible for authenticated attackers, with...