miniOrange Discord Integration < 2.1.6 - Subscriber+ App Disabling

The plugin does not have authorisation and CSRF in some of its AJAX actions, allowing any logged in users, such as subscriber to call them, and disable the app for example PoC Run the below command in the developer console of the web browser while being on the blog as any user, such as subscriber...

CVE-2022-38134

Authenticated subscriber+ Broken Access Control vulnerability in Customer Reviews for WooCommerce plugin = 5.3.5 at WordPress...

Booster for WooCommerce - Subscriber+ Order Status Update

The plugins allow users to update their own order status via a settings defined by admins when the My Account module is enabled, however does not ensure that the status set is allowed. As a result, users could set arbitrary status to their own orders, making them paid without actually paying for...

TaskBuilder < 1.0.8 - Subscriber+ Stored XSS via SVG file upload

The plugin does not validate and sanitise task's attachments, which could allow any authenticated user such as subscriber creating a task to perform Stored Cross-Site Scripting by attaching a malicious SVG file Create a SVG with the following content: alertdocument.cookie; As any authenticated...

Rate my Post < 3.3.5 - Subscriber+ Votes Tampering via Race Condition

The plugin is affected by a race condition issues allowing subscriber users to tamper with votes to increment to decrement them...

CVE-2022-38135

Broken Access Control vulnerability in Dean Oakley's Photospace Gallery plugin = 2.3.5 at WordPress allows users with subscriber or higher role to change plugin settings...

Photospace Gallery <= 2.3.5 - Subscriber+ Arbitrary Settings Update

The plugin does not have authorisation check when updating its settings, which could allow any authenticated users, such as subscriber to update them...

PT-2022-24229 · Dean Oakley · Photospace Gallery

Name of the Vulnerable Software and Affected Versions: Dean Oakley's Photospace Gallery plugin versions 2.3.5 and earlier Description: The issue allows users with a subscriber or higher role to change plugin settings due to a Broken Access Control vulnerability. This vulnerability affects the...

CVE-2022-38070

Privilege Escalation subscriber+ vulnerability in Pop-up plugin = 1.1.5 at WordPress...

CVE-2022-38058

Authenticated subscriber+ Plugin Setting change vulnerability in WP Shamsi plugin = 4.1.1 at WordPress...

CVE-2022-38058

Authenticated subscriber+ Plugin Setting change vulnerability in WP Shamsi plugin = 4.1.1 at WordPress...

Command injection

Authenticated subscriber+ Plugin Setting change vulnerability in WP Shamsi plugin = 4.1.1 at WordPress...

CVE-2022-38058

WP Shamsi plugin for WordPress is affected up to version 4.1.1 by an authenticated settings-change vulnerability. The root cause is missing authorization checks on plugin settings changes, allowing a subscriber+ to modify settings. Remediation: update to a version greater than 4.1.1 (Patch guidan...

CVE-2022-38070

CVE-2022-38070 affects the WordPress Pop-up plugin versions ≤ 1.1.5. The issue is a Privilege Escalation impacting subscribers+ (per the CVE entry), with no explicit exploitation details provided in the supplied documents. Root cause/technical specifics are not detailed beyond the vulnerability c...

Contact Form By Mega Forms < 1.2.5 - Subscriber+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some parameters, which could allow users with a role as low as subscriber to perform Stored Cross-Site Scripting attacks...

Frontend File Manager < 21.3 - Subscriber+ Arbitrary File Upload

The plugin allows any authenticated users, such as subscriber, to rename a file to an arbitrary extension, like PHP, which could allow them to basically be able to upload arbitrary files on the server and achieve RCE PoC 1. Navigate to the page where ffmwp shortcode is included as Subscriber 2...

Frontend File Manager < 21.3 - Subscriber+ Arbitrary File Upload

The plugin allows any authenticated users, such as subscriber, to rename a file to an arbitrary extension, like PHP, which could allow them to basically be able to upload arbitrary files on the server and achieve RCE 1. Navigate to the page where ffmwp shortcode is included as Subscriber 2. Uploa...

CVE-2022-2657

The Multivendor Marketplace Solution for WooCommerce WordPress plugin before 3.8.12 is lacking authorisation and CSRF in multiple AJAX actions, which could allow any authenticated users, such as subscriber to call them and suspend vendors reporter by the submitter or update arbitrary order status...

The vulnerability of the getAttrValue function in D-Link DSL-3782 router microprogramming software, related to buffer overflow in the stack, allows a hacker to execute arbitrary code.

The vulnerability of the getAttrValue function in D-Link DSL-3782 router microprogramming software is related to buffer overflow in the stack. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

WP Shamsi < 4.2.0 - Subscriber+ Settings Update

The plugin does not have authorisation check when updating its settings, which could allow any authenticated users, such as subscriber to update them...