WordPress WPForms plugin 1.8.4-1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation vulnerability

Missing Authorization to Authenticated Subscriber+ Payment Refund and Subscription Cancellation vulnerability discovered by villu164 in WordPress Plugin Contact Form by WPForms versions 1.8.4-1.9.2.1...

WordPress Event Tickets with Ticket Scanner plugin <= 2.4.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Missing Authorization to Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by zer0gh0st in WordPress Plugin Event Tickets with Ticket Scanner versions = 2.4.3...

WordPress SMS for Lead Capture Forms plugin <= 1.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Message Deletion vulnerability discovered by Mika in WordPress Plugin SMS for Lead Capture Forms versions = 1.1.0...

WordPress Gold Addons for Elementor plugin <= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) License Activation/Deactivation vulnerability

Missing Authorization to Authenticated Subscriber+ License Activation/Deactivation vulnerability discovered by BrokenAC ignore in WordPress Plugin Gold Addons for Elementor versions = 1.3.2...

WordPress Message Filter for Contact Form 7 plugin <= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) Filter Updates/Deletions vulnerability

Missing Authorization to Authenticated Subscriber+ Filter Updates/Deletions vulnerability discovered by Tieu Pham Trong Nhan in WordPress Plugin Message Filter for Contact Form 7 versions = 1.6.3...

CVE-2024-11844

The IdeaPush plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ideapushtaxonomysaveroutine function in all versions up to, and including, 8.71. This makes it possible for authenticated attackers, with Subscriber-level access and above...

CVE-2024-7747

The Wallet for WooCommerce plugin for WordPress is vulnerable to incorrect conversion between numeric types in all versions up to, and including, 1.5.6. This is due to a numerical logic flaw when transferring funds to another user. This makes it possible for authenticated attackers, with...

WordPress Image Alt Text plugin <= 2.0.0 - Missing Authorization to Authenticated (Subscriber+) Image Alt Text Update vulnerability

Missing Authorization to Authenticated Subscriber+ Image Alt Text Update vulnerability discovered by WordFence in WordPress Plugin Image Alt Text versions = 2.0.0...

WordPress WPGYM plugin <= 67.1.0 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation vulnerability

Missing Authorization to Authenticated Subscriber+ Privilege Escalation vulnerability discovered by Tonn in WordPress Plugin WPGYM versions = 67.1.0...

WordPress WPDash Notes plugin <= 1.3.5 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure vulnerability

Missing Authorization to Authenticated Subscriber+ Sensitive Information Exposure vulnerability discovered by Francesco Carlucci in WordPress Plugin WPDash Notes versions = 1.3.5...

CVE-2024-11154 PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes <= 3.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure

The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.15 via the 'actAjaxRevisionDiffs' function. This makes it possible for authenticated attackers,...

CVE-2024-10900

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmremovefileattachment function in all versions up to, and including, 5.9.3.6. This makes it possible for authenticated attacker...

WordPress ProfileGrid – User Profiles, Groups and Communities plugin <= 5.9.3.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Meta Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary User Meta Deletion vulnerability discovered by 1337Wannabe in WordPress Plugin ProfileGrid versions = 5.9.3.6...

CVE-2024-50522

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in redyyu WeChat Subscribers Lite wechat-subscribers-lite allows Reflected XSS.This issue affects WeChat Subscribers Lite : from n/a through = 1.6.6...

CVE-2024-50522

CVE-2024-50522 affects WordPress plugin WeChat Subscribers Lite (WeChat Subscribers Lite) up to version 1.6.6. The vulnerability is a Reflected Cross-Site Scripting (XSS) due to improper input neutralization during web page generation. Public docs confirm the affected software and vulnerability t...

CVE-2024-50522 WordPress WeChat Subscribers Lite plugin <= 1.6.6 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in redyyu WeChat Subscribers Lite wechat-subscribers-lite allows Reflected XSS.This issue affects WeChat Subscribers Lite : from n/a through = 1.6.6...

CVE-2024-50522 WordPress WeChat Subscribers Lite plugin <= 1.6.6 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in redyyu WeChat Subscribers Lite wechat-subscribers-lite allows Reflected XSS.This issue affects WeChat Subscribers Lite : from n/a through = 1.6.6...

WordPress plugin WeChat Subscribers Lite 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress Drop Shadow Boxes plugin <= 1.7.14 - Authenticated (Subscriber+) Arbitrary Shortcode Execution vulnerability

Authenticated Subscriber+ Arbitrary Shortcode Execution vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin Drop Shadow Boxes versions = 1.7.14...

WordPress WP Chat App plugin <= 3.6.8 - Missing Authorization to Authenticated (Subscriber+) Filebird Plugin Installation vulnerability

Missing Authorization to Authenticated Subscriber+ Filebird Plugin Installation vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin WP Chat App versions = 3.6.8...