CVE-2022-45066: Undefined Security Weakness

Auth. subscriber+ Broken Access Control vulnerability in WooSwipe WooCommerce Gallery plugin = 2.0.1 on WordPress...

CVE-2022-2450: Missing Authorization

The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 lacks authorization in various AJAX actions, allowing any logged-in users, such as subscribers to call them...

CVE-2022-41978: Undefined Security Weakness

Auth. subscriber+ Arbitrary Options Update vulnerability in Zoho CRM Lead Magnet plugin = 1.7.5.8 on WordPress...

CVE-2022-40205: Authorization Bypass Through User-Controlled Key

Insecure direct object references IDOR vulnerability in the wpForo Forum plugin = 2.0.5 on WordPress allows attackers with subscriber or higher user roles to mark any forum post as solved/unsolved...

CVE-2022-44795: Use of Insufficiently Random Values

An issue was discovered in Object First Ootbi BETA build 1.0.7.712. A flaw was found in the Web Service, which could lead to local information disclosure. The command that creates the URL for the support bundle uses an insecure RNG. That can lead to prediction of the generated URL. As a result, a...

CVE-2022-3536: Deserialization of Untrusted Data

The Role Based Pricing for WooCommerce WordPress plugin before 1.6.3 does not have authorisation and proper CSRF checks, as well as does not validate path given via user input, allowing any authenticated users like subscriber to perform PHAR deserialization attacks when they can upload a file, an...

CVE-2022-3401: Undefined Security Weakness

The Bricks theme for WordPress is vulnerable to remote code execution due to the theme allowing site editors to include executable code blocks in website content in versions 1.2 to 1.5.3. This, combined with the missing authorization vulnerability CVE-2022-3400, makes it possible for authenticate...

CVE-2022-3400: Missing Authorization

The Bricks theme for WordPress is vulnerable to authorization bypass due to a missing capability check on the brickssavepost AJAX action in versions 1.0 to 1.5.3. This makes it possible for authenticated attackers with minimal permissions, such as a subscriber, to edit any page, post, or template...

CVE-2022-3247: Server-Side Request Forgery (SSRF)

The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.9.10 does not have authorisation in an AJAX action, and does not ensure that the URL to make a request to is an external one. As a result, any authenticated users, such as subscriber could perform SSRF attacks...

CVE-2022-38070: Undefined Security Weakness

Privilege Escalation subscriber+ vulnerability in Pop-up plugin = 1.1.5 at WordPress...

CVE-2022-37244: Improper Neutralization of Input During Web Page Generation

MDaemon Technologies SecurityGateway for Email Servers 8.5.2 is vulnerable to IFRAME Injectionvia the currentRequest parameter. after login leads to inject malicious tag leads to IFRAME injection...

CVE-2022-36341: Improper Neutralization of Input During Web Page Generation

Authenticated subscriber+ plugin settings change leading to Stored Cross-Site Scripting XSS vulnerability in Akash soni's AS – Create Pinterest Pinboard Pages plugin = 1.0 at WordPress...

CVE-2022-33142: Uncontrolled Resource Consumption

Authenticated subscriber+ Denial Of Service DoS vulnerability in WordPlus WordPress Better Messages plugin = 1.9.10.57 at WordPress...

CVE-2022-2389: Missing Authorization

The Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami WordPress plugin before 2.1.2 does not have authorisation and CSRF checks in one of its AJAX action, allowing any authenticated users, such as subscriber to create automations...

CVE-2022-2382: Missing Authorization

The Product Slider for WooCommerce WordPress plugin before 2.5.7 has flawed CSRF checks and lack authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber to call them. One in particular could allow them to delete arbitrary blog options...

CVE-2022-2371: Improper Neutralization of Input During Web Page Generation

The YaySMTP WordPress plugin before 2.2.1 does not have proper authorisation when saving its settings, allowing users with a role as low as subscriber to change them, and use that to conduct Stored Cross-Site Scripting attack due to the lack of escaping in them as well...

CVE-2022-2369: Missing Authorization

The YaySMTP WordPress plugin before 2.2.1 does not have capability check in an AJAX action, allowing any logged in users, such as subscriber to view the Logs of the plugin...

CVE-2022-33960: Improper Neutralization of Special Elements used in an SQL Command

Multiple Authenticated subscriber or higher user role SQL Injection SQLi vulnerabilities in Social Share Buttons by Supsystic plugin = 2.2.3 at WordPress...

CVE-2022-1572: Cross-Site Request Forgery (CSRF)

The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks in an AJAX action, available to any authenticated users such as subscriber, which could allow them to delete arbitrary file...

CVE-2022-0745: Missing Authorization

The Like Button Rating WordPress plugin before 2.6.45 allows any logged-in user, such as subscriber, to send arbitrary e-mails to any recipient, with any subject and body...