CVE-2022-41788

The CVE-2022-41788 issue affects the Soledad premium theme for WordPress (versions ≤ 8.2.5). It is an authenticated XSS vulnerability exploitable by users with subscriber-level access or higher, caused by insufficient sanitisation/escaping of a parameter. A fix is available: upgrade the Soledad t...

CVE-2022-43492

CVE-2022-43492 affects WordPress with the wpDiscuz plugin at version 7.4.2. It is an Insecure Direct Object References (IDOR) in the Comments feature. The NVD entry lists CVSS v3.1 base metrics: 8.8 (High) with NEURAL: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; PatchStack cites a lower impact vector. R...

CVE-2022-40698 WordPress Quiz And Survey Master plugin <= 7.3.10 - Cross-Site Scripting (XSS) vulnerability

Auth. subscriber+ Cross-Site Scripting XSS vulnerability in Quiz And Survey Master plugin = 7.3.10 on WordPress...

CVE-2022-40698

Summary: CVE-2022-40698 is a cross-site scripting (XSS) vulnerability affecting the WordPress plugin “Quiz And Survey Master” (versions

PT-2022-25983 · Unknown · Bp Better Messages

Name of the Vulnerable Software and Affected Versions: Better Messages plugin version 1.9.10.68 Description: The issue is related to an Authenticated Server-Side Request Forgery SSRF vulnerability. This means that an attacker could potentially forge requests to internal or external services, but...

PT-2022-26073 · WordPress · Soledad

Name of the Vulnerable Software and Affected Versions: Soledad premium theme version 8.2.5 and earlier Description: A Cross-Site Scripting XSS issue affects the Soledad premium theme on WordPress, specifically for users with subscriber or higher authentication. This issue allows for malicious...

PT-2022-25288 · WordPress · Bp Better Messages

Name of the Vulnerable Software and Affected Versions: Better Messages plugin versions = 1.9.10.69 Description: The issue is related to an authentication bypass vulnerability in the Better Messages plugin for WordPress, specifically affecting messaging block functionality for subscribers and abov...

PT-2022-24630 · WordPress · Wpml Multilingual Cms

Name of the Vulnerable Software and Affected Versions: WPML Multilingual CMS premium plugin versions = 4.5.10 Description: The issue allows users with subscriber or higher user roles to change the status of the translation jobs due to a Broken Access Control vulnerability in the WPML Multilingual...

PT-2022-25232 · WordPress · Wp-Polls

Name of the Vulnerable Software and Affected Versions: WP-Polls plugin versions prior to 2.76.1 Description: A race condition issue exists in the WP-Polls plugin, affecting users with subscriber or higher permissions. This issue can be exploited due to improper synchronization, potentially leadin...

CVE-2022-45066

Auth. subscriber+ Broken Access Control vulnerability in WooSwipe WooCommerce Gallery plugin = 2.0.1 on WordPress...

CVE-2022-41791

Auth. subscriber+ CSV Injection vulnerability in ProfileGrid plugin = 5.1.6 on WordPress...

CVE-2022-40200

Auth. subscriber+ Arbitrary File Upload vulnerability in wpForo Forum plugin = 2.0.9 on WordPress...

CVE-2022-38461

Broken Access Control vulnerability in WPML Multilingual CMS premium plugin = 4.5.10 on WordPress allows users with a subscriber or higher user role to change plugin settings selected language for legacy widgets, the default behavior for media content...

CVE-2022-45066

CVE-2022-45066 affects the WordPress plugin WooSwipe WooCommerce Gallery, version

CVE-2022-40200

The CVE CVE-2022-40200 affects the WordPress wpForo Forum plugin prior to 2.0.9. Authenticated users (subscriber+) can upload arbitrary files due to a vulnerability in the plugin, enabling potential unauthorized file writes. The issue is documented across multiple sources (NVD/NVD-derived records...

WooSwipe WooCommerce Gallery <= 2.0.1 - Subscriber+ Settings Update

The plugin does not have any authorisation when updating its settings, which could allow any authenticated users, such as subscriber to update them POST /wp-admin/admin.php?page=wooswipe-options HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8...

PT-2022-27402 · WordPress · Betheme

Name of the Vulnerable Software and Affected Versions: Betheme theme versions = 26.5.1.4 Description: The issue is related to an authentication bypass vulnerability, specifically a PHP Object Injection vulnerability, affecting the Betheme theme on WordPress. It requires authentication as a...

PT-2022-24416 · WordPress · Wpml Multilingual Cms

Name of the Vulnerable Software and Affected Versions: WPML Multilingual CMS premium plugin versions = 4.5.10 Description: The issue allows users with a subscriber or higher user role to change plugin settings, including the selected language for legacy widgets and the default behavior for media...

VulnCheck KEV: CVE-2022-45077

Auth. subscriber+ PHP Object Injection vulnerability in Betheme theme = 26.5.1.4 on WordPress...

CVE-2022-44005

An issue was discovered in BACKCLICK Professional 5.9.63. Due to the use of consecutive IDs in verification links, the newsletter sign-up functionality is vulnerable to the enumeration of subscribers' e-mail addresses. Furthermore, it is possible to subscribe and verify other persons' e-mail...