CVE-2025-9542 AutomatorWP <= 5.3.7 - Authenticated (Subscriber+) Missing Authorization to Multiple Functions

The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on multiple plugin's functions in all versions up to, and including, 5.3.7...

CVE-2025-9489

The The WP-Members Membership Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.5.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it...

CVE-2025-9489

CVE-2025-9489 affects the WP-Members Membership Plugin for WordPress. The vulnerability allowsAuthenticated users with Subscriber+ to execute arbitrary shortcodes via do_shortcode due to insufficient input validation in profile-related shortcode handling. Impact is arbitrary shortcode execution w...

PT-2025-36571

Name of the Vulnerable Software and Affected Versions: The WP-Members Membership Plugin versions prior to 3.5.4.3 Description: The WP-Members Membership Plugin is susceptible to arbitrary shortcode execution. This occurs because the software does not properly validate a value before running do...

Fedora 42 : snapshot (2025-ed3d0ab54b)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-ed3d0ab54b advisory. Rebuild with tracing-subscriber v0.3.20 for CVE-2025-58160. Tenable has extracted the preceding description block directly from the Fedora security advisory...

PT-2025-36578

Name of the Vulnerable Software and Affected Versions: AutomatorWP – Automator plugin for WordPress versions prior to 5.3.7 Description: The AutomatorWP – Automator plugin for WordPress is susceptible to unauthorized data modification due to a missing capability check on the automatorwp ajax impo...

PT-2025-36579

Name of the Vulnerable Software and Affected Versions: AutomatorWP – Automator plugin for WordPress versions through 5.3.7 Description: The AutomatorWP – Automator plugin for WordPress is susceptible to unauthorized access and modification of data. This is due to a missing capability check on...

WordPress AutomatorWP plugin <= 5.3.6 - Missing Authorization To Authenticated (Subscriber+) Remote Code Execution via Automation Creation vulnerability

Missing Authorization To Authenticated Subscriber+ Remote Code Execution via Automation Creation vulnerability discovered by stealthcopter in WordPress Plugin AutomatorWP versions = 5.3.6...

CVE-2025-9112 Doccure <= 1.4.8 - Authenticated (Subscriber+) Arbitrary File Upload

The Doccure theme for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the 'doccuretempfileuploader' function in all versions up to, and including, 1.4.8. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to...

CVE-2025-9112

The CVE CVE-2025-9112 affects the Doccure WordPress theme (versions up to and including 1.4.8). The root cause is incorrect file type validation in the doccure_temp_file_uploader function, enabling authenticated users with subscriber-level or higher privileges to upload arbitrary files to the ser...

PT-2025-36493

Name of the Vulnerable Software and Affected Versions: Doccure theme for WordPress versions through 1.4.8 Description: The Doccure theme for WordPress is susceptible to arbitrary file uploads due to inadequate file type validation within the doccure temp file uploader function. Authenticated...

WordPress OceanWP theme < 4.1.2 - Subscriber+ Limited Option Update vulnerability

Subscriber+ Limited Option Update vulnerability discovered by Hamit Cibo in WordPress Theme OceanWP versions 4.1.2...

CVE-2025-9219

The Post SMTP – WP SMTP Plugin with Email Logs and Mobile App for Failure Notifications – Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES and more plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updatepostsmtpprooptioncallback'...

CVE-2025-21027

Improper verification of intent by broadcast receiver in ImsService prior to SMR Sep-2025 Release 1 allows local attackers to temporarily disable the SIM...

CVE-2025-8944 OceanWP < 4.1.2 - Subscriber+ Limited Option Update

The OceanWP WordPress theme before 4.1.2 is vulnerable to an option update due to a missing capability check on one of its AJAX request handler, allowing any authenticated users, such as subscriber to update the darkMod setting...

WordPress SoftMe Theme <= 1.1.24 is vulnerable to Broken Access Control

Software SoftMe Type Theme Vulnerable versions = 1.1.24 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2025-58817 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 73da99fa2c92 Credits Martino Spagnuolo r3verii Required...

PT-2025-36114

Name of the Vulnerable Software and Affected Versions OceanWP WordPress theme versions prior to 4.1.2 Description The OceanWP WordPress theme is susceptible to unauthorized option updates due to a missing capability check within an AJAX request handler. This allows any authenticated user, even...

WordPress Mobile Contact Line Plugin <= 2.4.0 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by 0xbeven in WordPress Plugin Mobile Contact Line versions = 2.4.0...

WordPress F4 Media Taxonomies Plugin <= 1.1.4 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Nabil Irawan in WordPress Plugin F4 Media Taxonomies versions = 1.1.4...

WordPress Classified Listing Plugin <= 5.0.6 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Denver Jackson in WordPress Plugin Classified Listing versions = 5.0.6...