WordPress MasterStudy LMS Plugin <= 3.6.20 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Bibek Dhakal in WordPress Plugin MasterStudy LMS versions = 3.6.20...

WordPress wpDiscuz Plugin <= 7.6.33 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Legion Hunter in WordPress Plugin wpDiscuz versions = 7.6.33...

CVE-2025-10305

The Secure Passkeys plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the deletepasskey and passkeyslist function in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, t...

WordPress WPLMS Theme <= 4.970 is vulnerable to Broken Access Control

Software WPLMS Type Theme Vulnerable versions = 4.970 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2025-58668 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID b45c9c5a0459 Credits Rafie Muhammad Patchstack Required privile...

CVE-2025-10305

The Secure Passkeys plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the deletepasskey and passkeyslist function in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, t...

CVE-2025-10305 Secure Passkeys <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Passkey Exposure and Deletion

The Secure Passkeys plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the deletepasskey and passkeyslist function in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, t...

CVE-2025-10305 Secure Passkeys <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Passkey Exposure and Deletion

The Secure Passkeys plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the deletepasskey and passkeyslist function in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, t...

CVE-2025-10305

CVE-2025-10305 documents a vulnerability in the WordPress Secure Passkeys plugin (versions up to and including 1.2.1) where delete_passkey() and passkeys_list() lack proper authorization checks. This allows authenticated users with Subscriber+ privileges to view and delete passkeys. The issue has...

WordPress Secure Passkeys plugin <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Passkey Exposure and Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Passkey Exposure and Deletion vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Secure Passkeys versions = 1.2.1...

PT-2025-38630

Name of the Vulnerable Software and Affected Versions Secure Passkeys plugin for WordPress versions up to and including 1.2.1 Description The Secure Passkeys plugin for WordPress is susceptible to unauthorized access due to a missing capability check within the delete passkey and passkeys list...

CVE-2025-8999

The Sydney theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'activatemodules' function in all versions up to, and including, 2.56. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate...

CVE-2025-10647

The CVE-2025-10647 entry refers to the WordPress plugin Embed PDF for WPForms. Affected versions are

CVE-2025-9215

The StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.0 via the filedownload function. This makes it possible for authenticated attackers, with...

CVE-2025-10058

The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the uploadfunction function in all versions up to, and including, 7.27. This makes it possible for authenticated attackers, with...

CVE-2025-10057

The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.28. This is due to the writetocustomfile function writing unfiltered PHP code to a file. This makes it possible for authenticated attackers,...

CVE-2025-8487

The Kubio AI Page Builder plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the kubio-image-hub-install-plugin AJAX action in all versions up to, and including, 2.6.3. This makes it possible for authenticated attackers, with Subscriber-lev...

CVE-2025-8487

CVE-2025-8487 affects Kubio AI Page Builder for WordPress up to version 2.6.3. The vulnerability is caused by a missing capability check on the kubio-image-hub-install-plugin AJAX action, enabling authenticated users with Subscriber-level access and above to install the Image Hub plugin. Exploita...

CVE-2025-8487 Kubio AI Page Builder <= 2.6.3 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation

The Kubio AI Page Builder plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the kubio-image-hub-install-plugin AJAX action in all versions up to, and including, 2.6.3. This makes it possible for authenticated attackers, with Subscriber-lev...

CVE-2025-8487 Kubio AI Page Builder <= 2.6.3 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation

The Kubio AI Page Builder plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the kubio-image-hub-install-plugin AJAX action in all versions up to, and including, 2.6.3. This makes it possible for authenticated attackers, with Subscriber-lev...

PT-2025-38508

Name of the Vulnerable Software and Affected Versions Kubio AI Page Builder plugin for WordPress versions up to and including 2.6.3 Description The Kubio AI Page Builder plugin for WordPress is susceptible to unauthorized plugin installation due to a missing capability check on the...