WordPress WP Courses LMS Plugin <= 3.2.3 is vulnerable to Broken Access Control

Software WP Courses LMS Type Plugin Vulnerable versions = 3.2.3 Fixed in 3.2.4 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE N/A Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 45ff52ba1951 Credits Unknown Required privilege Subscriber...

WordPress Acme Fix Images Plugin <= 1.0.0 is vulnerable to Broken Access Control

Software Acme Fix Images Type Plugin Vulnerable versions = 1.0.0 Fixed in 2.0.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-47793 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 51b5ada66dce Credits Abdi Pranata Required...

WP Project Manager < 2.6.1 - Subscriber+ SQLi

Description The plugin does not properly sanitise and escape the user task starting date parameter before using it in a SQL statement, leading to a SQL injection exploitable by any authenticated users, such as subscriber...

WordPress WP Courses LMS Plugin <= 3.2.3 is vulnerable to Broken Access Control

Software WP Courses LMS Type Plugin Vulnerable versions = 3.2.3 Fixed in 3.2.4 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE N/A Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 788c62b14a2a Credits Unknown Required privilege Subscriber...

WordPress LuckyWP Scripts Control Plugin <= 1.2.1 is vulnerable to Broken Access Control

Software LuckyWP Scripts Control Type Plugin Vulnerable versions = 1.2.1 Fixed in 1.2.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-47778 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 0397d6dac11d Credits Abdi Pranata...

WordPress Essential Grid Plugin <= 3.0.18 is vulnerable to Broken Access Control

Software Essential Grid Type Plugin Vulnerable versions = 3.0.18 Fixed in 3.0.19 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-47771 Patch priority High CVSS severity High 8.3 Developer Claim ownership PSID 7ac8b383b58b Credits Rafie Muhammad Patchstack...

WordPress miniorange otp verification Plugin <= 4.2.1 is vulnerable to Broken Access Control

Software miniorange otp verification Type Plugin Vulnerable versions = 4.2.1 Fixed in 4.2.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-47776 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 60649c9bd1ee Credits Abdi Pranat...

WordPress Simple 301 Redirects by BetterLinks Plugin <= 2.0.7 is vulnerable to Broken Access Control

Software Simple 301 Redirects by BetterLinks Type Plugin Vulnerable versions = 2.0.7 Fixed in 2.0.8 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-47761 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 76b78ec76a84 Credits Abd...

WordPress ElementsKit Pro Plugin <= 3.3.0 is vulnerable to Broken Access Control

Software ElementsKit Pro Type Plugin Vulnerable versions = 3.3.0 Fixed in 3.6.8 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-39993 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID b8963eeda442 Credits Rafie Muhammad Patchsta...

WordPress WP Custom Admin Interface Plugin <= 7.31 is vulnerable to Broken Access Control

Software WP Custom Admin Interface Type Plugin Vulnerable versions = 7.31 Fixed in 7.32 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-47763 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 73d0182de151 Credits Abdi Pranata...

WordPress Themify Ultra Theme <= 7.3.5 is vulnerable to Broken Access Control

Software Themify Ultra Type Theme Vulnerable versions = 7.3.5 Fixed in 7.3.6 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-46146 Patch priority High CVSS severity High 8.3 Developer Claim ownership PSID dba7a9d87836 Credits Rafie Muhammad Patchstack...

WordPress Flo Forms Plugin <= 1.0.41 is vulnerable to Broken Access Control

Software Flo Forms Type Plugin Vulnerable versions = 1.0.41 Fixed in 1.0.42 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-47692 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 415778b368e8 Credits Abdi Pranata Required...

WordPress Mini Cart Drawer For WooCommerce Plugin <= 4.0.0 is vulnerable to Broken Access Control

Software Mini Cart Drawer For WooCommerce Type Plugin Vulnerable versions = 4.0.0 Fixed in 4.0.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-47694 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID d5e11a29b0ee Credits Abdi Pranata...

WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) Plugin <= 7.6.6 is vulnerable to Privilege Escalation

Software WordPress Social Login and Register Discord, Google, Twitter, LinkedIn Type Plugin Vulnerable versions = 7.6.6 Fixed in 7.6.7 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2023-47683 Patch priority High CVSS severity High 8...

CVE-2023-5506

The ImageMapper plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'imgmapdeleteareaajax' function in versions up to, and including, 1.2.6. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to...

Design/Logic Flaw

The ImageMapper plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'imgmapdeleteareaajax' function in versions up to, and including, 1.2.6. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to...

CVE-2023-5506 ImageMapper <= 1.2.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page/Post Deletion via imgmap_delete_area_ajax

The ImageMapper plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'imgmapdeleteareaajax' function in versions up to, and including, 1.2.6. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to...

WordPress ImageMapper Plugin <= 1.2.6 is vulnerable to Broken Access Control

Software ImageMapper Type Plugin Vulnerable versions = 1.2.6 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-5506 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 273249a3fdc4 Credits Lana Codes Required privilege...

WordPress Easy Social Icons Plugin <= 3.2.5 is vulnerable to Broken Access Control

Software Easy Social Icons Type Plugin Vulnerable versions = 3.2.5 Fixed in 3.2.6 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-33998 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 69598c192853 Credits Nguyen Anh Tien Required...

WordPress BadgeOS Plugin <= 3.7.1.6 is vulnerable to Broken Access Control

Software BadgeOS Type Plugin Vulnerable versions = 3.7.1.6 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-47647 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 662abc807ad6 Credits Elliot Required privilege Subscriber...