2359 matches found
PT-2024-16357 · Tumult · Tumult Hype Animations
Name of the Vulnerable Software and Affected Versions: Tumult Hype Animations plugin for WordPress versions up to, and including, 1.9.14 Description: The issue is related to unauthorized access of data due to a missing capability check on the hypeanimations getcontent function. This allows...
WordPress WeChat Subscribers Lite plugin <= 1.6.6 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by Muhamad Agil Fachrian Patchstack Alliance in WordPress Plugin WeChat Subscribers Lite versions = 1.6.6...
WordPress WeChat Subscribers Lite Plugin <= 1.6.6 is vulnerable to Cross Site Scripting (XSS)
Software WeChat Subscribers Lite Type Plugin Vulnerable versions = 1.6.6 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-50522 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 6111364515e3 Credits Muhamad Agil Fachrian...
WordPress Contact Form 7 Telegram plugin <= 0.8.5 - Missing Authorization to Authenticated (Subscriber+) Subscription Approve/Pause/Refuse vulnerability
Missing Authorization to Authenticated Subscriber+ Subscription Approve/Pause/Refuse vulnerability discovered by István Márton in WordPress Plugin Contact Form 7 Telegram versions = 0.8.5...
PT-2024-16020 · WordPress · Download Monitor
Name of the Vulnerable Software and Affected Versions: Download Monitor plugin for WordPress versions up to, and including, 5.0.12 Description: The issue allows authenticated attackers with Subscriber-level access and above to modify data without authorization due to a missing capability check on...
PT-2024-39728 · WordPress · Wps Telegram Chat
Name of the Vulnerable Software and Affected Versions: WPS Telegram Chat plugin for WordPress versions up to, and including, 4.5.4 Description: The issue allows authenticated attackers with subscriber-level access and above to have full access to the Telegram Bot API endpoint and communicate with...
CVE-2024-10079
The WP Easy Post Types plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.4.4 via deserialization of untrusted input from the 'text' parameter in the 'ajaximportcontent' function. This allows authenticated attackers, with subscriber-level permissions an...
WordPress SendGrid for WordPress plugin <= 1.4 - Missing Authorization to Authenticated (Subscriber+) Log Deletion vulnerability
Missing Authorization to Authenticated Subscriber+ Log Deletion vulnerability discovered by Nishiv in WordPress Plugin SendGrid for WordPress versions = 1.4...
CVE-2020-36831
The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on multiple user privilege/security functions provided in versions up to, and including 4.3.17. This makes it possible for low-privileged attackers, like...
CVE-2024-9104 UltimateAI <= 2.8.3 - Limited User Password Change due to Improper Empty and Missing Default Value Check
The UltimateAI plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.8.3. This is due to the improper empty value check and a missing default activated value check in the 'ultimateaichangepass' function. This makes it possible for unauthenticated...
CVE-2024-9104 UltimateAI <= 2.8.3 - Limited User Password Change due to Improper Empty and Missing Default Value Check
The UltimateAI plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.8.3. This is due to the improper empty value check and a missing default activated value check in the 'ultimateaichangepass' function. This makes it possible for unauthenticated...
WordPress Multiline files upload for contact form 7 plugin <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation vulnerability
Missing Authorization to Authenticated Subscriber+ Plugin Deactivation vulnerability discovered by Tieu Pham Trong Nhan in WordPress Plugin Multiline files upload for contact form 7 versions = 2.8.1...
VulnCheck KEV: CVE-2021-4445
The Premium Addons for Elementor plugin for WordPress is vulnerable to Arbitrary Option Updates in versions up to, and including, 4.5.1. This is due to missing capability and nonce checks in the padismissadminnotice AJAX action. This makes it possible for authenticated subscriber+ attackers to...
WordPress ImagePress plugin <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Post Title Update vulnerability
Missing Authorization to Authenticated Subscriber+ Arbitrary Post Deletion and Post Title Update vulnerability discovered by Michelle Porter in WordPress Plugin ImagePress versions = 1.2.2...
Exploit for CVE-2024-2876
CVE-2024-2876 - SQL Injection Vulnerability in Email Subscribe...
WordPress Robo Gallery plugin <= 3.2.21 - Missing Authorization to Authenticated (Subscriber+) Private Gallery Title Disclosure vulnerability
Missing Authorization to Authenticated Subscriber+ Private Gallery Title Disclosure vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Robo Gallery versions = 3.2.21...
PT-2024-39220 · Unknown · Bit File Manager
Name of the Vulnerable Software and Affected Versions: The Bit File Manager versions up to, and including, 6.5.7 Description: The issue is due to a lack of proper checks on allowed file types, making it possible for authenticated attackers with Subscriber-level access and above, and granted...
CVE-2024-8254
The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.7.34. This is due to the software allowing users to execute an action that do...
CVE-2024-8254
The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.7.34. This is due to the software allowing users to execute an action that do...
