CVE-2022-3991: Improper Neutralization of Input During Web Page Generation

The Photospace Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters saved via the update function in versions up to, and including, 2.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...

CVE-2022-3995: Authorization Bypass Through User-Controlled Key

The TeraWallet plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 1.4.3. This is due to insufficient validation of the user-controlled key on the lockunlockterawallet AJAX action. This makes it possible for authenticated attackers, with...

CVE-2022-4028: Improper Neutralization of Input During Web Page Generation

The Simple:Press plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postitem' parameter manipulated during the profile-save action when modifying a profile signature in versions up to, and including, 6.8 due to insufficient input sanitization and output escaping that makes...

CVE-2022-3511: Undefined Security Weakness

The Awesome Support WordPress plugin before 6.1.2 does not ensure that the exported tickets archive to be downloaded belongs to the user making the request, allowing a low privileged user, such as subscriber to download arbitrary exported tickets via an IDOR vector...

CVE-2021-25059: Undefined Security Weakness

The Download Plugin WordPress plugin before 2.0.0 does not properly validate a user has the required privileges to access a backup's nonce identifier, which may allow any users with an account on the site such as subscriber to download a full copy of the website...

CVE-2022-45363: Improper Neutralization of Input During Web Page Generation

Auth. subscriber+ Stored Cross-Site Scripting XSS in Muffingroup Betheme theme = 26.6.1 on WordPress...

CVE-2022-3861: Deserialization of Untrusted Data

The Betheme theme for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 26.5.1.4 via deserialization of untrusted input supplied via the import, mfn-items-import-page, and mfn-items-import parameters passed through the mfnbuilderimport, mfnbuilderimportpage,...

CVE-2022-41788: Improper Neutralization of Input During Web Page Generation

Auth. subscriber+ Cross-Site Scripting XSS vulnerability in Soledad premium theme = 8.2.5 on WordPress...

CVE-2022-40130: Concurrent Execution using Shared Resource with Improper Synchronization

Auth. subscriber+ Race Condition vulnerability in WP-Polls plugin = 2.76.0 on WordPress...

CVE-2022-41609: Server-Side Request Forgery (SSRF)

Auth. subscriber+ Server-Side Request Forgery SSRF vulnerability in Better Messages plugin 1.9.10.68 on WordPress...

CVE-2022-41655: Exposure of Sensitive Information to an Unauthorized Actor

Auth. subscriber+ Sensitive Data Exposure vulnerability in Phone Orders for WooCommerce plugin = 3.7.1 on WordPress...

CVE-2022-40216: Improper Access Control

Auth. subscriber+ Messaging Block Bypass vulnerability in Better Messages plugin = 1.9.10.69 on WordPress...

CVE-2022-40698: Improper Neutralization of Input During Web Page Generation

Auth. subscriber+ Cross-Site Scripting XSS vulnerability in Quiz And Survey Master plugin = 7.3.10 on WordPress...

CVE-2022-45369: Undefined Security Weakness

Auth. subscriber+ Broken Access Control vulnerability in Plugin for Google Reviews plugin = 2.2.2 on WordPress...

CVE-2022-45077: Deserialization of Untrusted Data

Auth. subscriber+ PHP Object Injection vulnerability in Betheme theme = 26.5.1.4 on WordPress...

CVE-2022-45066: Undefined Security Weakness

Auth. subscriber+ Broken Access Control vulnerability in WooSwipe WooCommerce Gallery plugin = 2.0.1 on WordPress...

CVE-2022-2450: Missing Authorization

The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 lacks authorization in various AJAX actions, allowing any logged-in users, such as subscribers to call them...

CVE-2022-41978: Undefined Security Weakness

Auth. subscriber+ Arbitrary Options Update vulnerability in Zoho CRM Lead Magnet plugin = 1.7.5.8 on WordPress...

CVE-2022-40205: Authorization Bypass Through User-Controlled Key

Insecure direct object references IDOR vulnerability in the wpForo Forum plugin = 2.0.5 on WordPress allows attackers with subscriber or higher user roles to mark any forum post as solved/unsolved...

CVE-2022-44795: Use of Insufficiently Random Values

An issue was discovered in Object First Ootbi BETA build 1.0.7.712. A flaw was found in the Web Service, which could lead to local information disclosure. The command that creates the URL for the support bundle uses an insecure RNG. That can lead to prediction of the generated URL. As a result, a...