CVE-2023-1026: Missing Authorization

The WP Meta SEO plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the listPostsCategory function in versions up to, and including, 4.5.3. This makes it possible for authenticated attackers with subscriber-level access to get post listings by...

CVE-2023-1023: Missing Authorization

The WP Meta SEO plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the saveSitemapSettings function in versions up to, and including, 4.5.3. This makes it possible for authenticated attackers with subscriber-level access to change...

CVE-2023-1024: Missing Authorization

The WP Meta SEO plugin for WordPress is vulnerable to unauthorized sitemap generation due to a missing capability check on the regenerateSitemaps function in versions up to, and including, 4.5.3. This makes it possible for authenticated attackers with subscriber-level access to generate sitemaps...

CVE-2023-1027: Missing Authorization

The WP Meta SEO plugin for WordPress is vulnerable to unauthorized sitemap generation due to a missing capability check on the checkAllCategoryInSitemap function in versions up to, and including, 4.5.3. This makes it possible for authenticated attackers with subscriber-level access to obtain post...

PT-2023-16474

Name of the Vulnerable Software and Affected Versions Wicked Folders plugin for WordPress versions up to, and including, 2.18.16 Description The issue is related to a missing capability check on the ajax save folder function, allowing authenticated attackers with subscriber-level permissions and...

CVE-2022-4702

The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wprfixroyalcompatibility' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to deactivate every plugin on...

PT-2022-25479

Name of the Vulnerable Software and Affected Versions Quiz And Survey Master plugin versions = 7.3.10 Description The issue is related to an Authenticated Cross-Site Scripting XSS vulnerability. This means that an attacker who has subscriber-level access or higher can inject malicious scripts int...

PT-2022-19592

Name of the Vulnerable Software and Affected Versions 3xSocializer plugin versions 0.98.22 and earlier Description The issue is related to a SQL Injection SQLi vulnerability. This vulnerability can be exploited by users with a low role, such as a subscriber or higher, in WordPress. Recommendation...

PT-2022-11308

Name of the Vulnerable Software and Affected Versions WHMCS Bridge WordPress plugin versions up to and including 6.1 Description The issue allows attackers to inject arbitrary web scripts via the cc whmcs bridge url parameter in the /whmcs-bridge/bridge cp.php file. This is due to missing...

PT-2021-15752

Name of the Vulnerable Software and Affected Versions: WP Page Builder versions prior to 1.2.4 Description: The issue allows subscriber-level users to edit and make changes to any and all posts and pages by default, unless user roles are specifically blocked from editing posts and pages...