WordPress GS Insever Portfolio plugin <= 1.4.5 - Missing Authorization to Authenticated (Subscriber+) CSS Injection vulnerability

Missing Authorization to Authenticated Subscriber+ CSS Injection vulnerability discovered by Peter Thaleikis in WordPress Plugin GS Insever Portfolio versions = 1.4.5...

CVE-2024-11270

The WordPress Webinar Plugin – WebinarPress plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check on the 'sync-import-imgs' function and missing file type validation in all versions up to, and including, 1.33.24. This makes it possible for authenticated...

PT-2025-1714 · WordPress · Wp Extended

Name of the Vulnerable Software and Affected Versions: The Ultimate WordPress Toolkit – WP Extended plugin for WordPress versions up to, and including, 3.0.11 Description: The issue is related to a missing capability check on several functions, allowing authenticated attackers with subscriber-lev...

WordPress WP Job Portal plugin <= 2.2.5- Authenticated (Subscriber+) Insecure Direct Object Reference vulnerability

WordPress WP Job Portal plugin = 2.2.5- Authenticated Subscriber+ Insecure Direct Object Reference vulnerability discovered by Apostolos Sakellariou in WordPress Plugin WP Job Portal versions = 2.2.5...

WordPress SMS Alert Order Notifications – WooCommerce plugin <= 3.7.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Options Update vulnerability discovered by 1337Wannabe in WordPress Plugin SMS Alert Order Notifications versions = 3.7.6...

WordPress Aurum theme <= 4.0.2 - Missing Authorization to Authenticated (Subscriber+) Demo Content Import vulnerability

Missing Authorization to Authenticated Subscriber+ Demo Content Import vulnerability discovered by Lucio Sá in WordPress Theme Aurum versions = 4.0.2...

WordPress WordLift plugin <= 3.54.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update vulnerability

Missing Authorization to Authenticated Subscriber+ Settings Update vulnerability discovered by Tieu Pham Trong Nhan in WordPress Plugin WordLift versions = 3.54.2...

WordPress Email Subscribers plugin < 5.7.44 - Admin+ SQL Injection vulnerability

Admin+ SQL Injection vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Email Subscribers & Newsletters versions 5.7.44...

CVE-2024-12311

The Email Subscribers by Icegram Express WordPress plugin before 5.7.44 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...

CVE-2024-12311

The Email Subscribers by Icegram Express WordPress plugin before 5.7.44 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...

CVE-2024-12311 Email Subscribers < 5.7.44 - Admin+ SQL Injection

The Email Subscribers by Icegram Express WordPress plugin before 5.7.44 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...

CVE-2024-12311 Email Subscribers < 5.7.44 - Admin+ SQL Injection

The Email Subscribers by Icegram Express WordPress plugin before 5.7.44 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks...

CVE-2024-12311

CVE-2024-12311 affects Icegram Express (Email Subscribers by Icegram Express) for WordPress. The vulnerability is an SQL injection in the plugin’s handling of a parameter that is not properly sanitized/escaped before being used in an SQL statement. This could allow an authenticated admin to manip...

PT-2025-1810 · Icegram Express · Email Subscribers

Name of the Vulnerable Software and Affected Versions: Email Subscribers by Icegram Express versions prior to 5.7.44 Description: The issue concerns a SQL injection vulnerability. It occurs because a parameter is not properly sanitized and escaped before being used in a SQL statement, allowing...

WordPress PlugVersions plugin <= 0.0.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Creation vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary File Creation vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin PlugVersions versions = 0.0.7...

WordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 5.4.0 - Missing Authorization to Authenticated (Subscriber+) Logo Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Logo Deletion vulnerability discovered by Tieu Pham Trong Nhan in WordPress Plugin Print Invoice & Delivery Notes for WooCommerce versions = 5.4.0...

WordPress WP BASE Booking plugin <= 4.9.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via app_export_db vulnerability

Missing Authorization to Authenticated Subscriber+ Sensitive Information Exposure via appexportdb vulnerability discovered by Thanh Nam Tran in WordPress Plugin WP BASE Booking versions = 4.9.2...

WordPress WP Project Manager plugin <= 2.6.15 - Authenticated (Subscriber+) Sensitive Information Exposure via Project Task List REST API vulnerability

Authenticated Subscriber+ Sensitive Information Exposure via Project Task List REST API vulnerability discovered by Noah Stead TurtleBurg in WordPress Plugin WP Project Manager versions = 2.6.15...

WordPress WP Crowdfunding plugin <= 2.1.12 - Missing Authorization to Authenticated (Subscriber+) WooCommerce Installation vulnerability

Missing Authorization to Authenticated Subscriber+ WooCommerce Installation vulnerability discovered by Tieu Pham Trong Nhan in WordPress Plugin WP Crowdfunding versions = 2.1.12...

WordPress Custom Skins Contact Form 7 plugin <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Update and Skin Creation vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Post Update and Skin Creation vulnerability discovered by Lucio Sá in WordPress Plugin Custom Skins Contact Form 7 versions = 1.0...