CVE-2024-1210 LearnDash LMS <= 4.10.1 - Sensitive Information Exposure via API

The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.1 via API. This makes it possible for unauthenticated attackers to obtain access to quizzes...

CVE-2023-7014 Author Box, Guest Author and Co-Authors for Your Posts – Molongui <= 4.7.4 - Information Exposure via ma_debug

The Author Box, Guest Author and Co-Authors for Your Posts – Molongui plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.7.4 via the 'madebu' parameter. This makes it possible for unauthenticated attackers to extract sensitive data includi...

CVE-2024-0859 Affiliates Manager <= 2.9.34 - Cross-Site Request Forgery

The Affiliates Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.9.34. This is due to missing or incorrect nonce validation on the processbulkaction function in ListAffiliatesTable.php. This makes it possible for unauthenticated...

CVE-2024-0374 Views for WPForms <= 3.2.2 - Cross-Site Request Forgery via create_view

The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.2. This is due to missing or incorrect nonce validation on the 'createview' function. This makes it possible for...

CVE-2024-0761 File Manager <= 7.2.1 - Sensitive Information Exposure via Backup Filenames

The File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.2.1 due to insufficient randomness in the backup filenames, which use a timestamp plus 4 random digits. This makes it possible for unauthenticated attackers, to extract...

CVE-2024-0761 File Manager <= 7.2.1 - Sensitive Information Exposure via Backup Filenames

The File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.2.1 due to insufficient randomness in the backup filenames, which use a timestamp plus 4 random digits. This makes it possible for unauthenticated attackers, to extract...

Advanced Forms for ACF < 1.9.3.3 - Missing Authorization to Unauthenticated Form Settings Export

Description The Advanced Forms for ACF plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportjsonfile function in all versions up to, and including, 1.9.3.2. This makes it possible for unauthenticated attackers to export form settings...

Biteship < 2.2.25 - Reflected Cross-Site Scripting via biteship_error and biteship_message

Description The Biteship plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'biteshiperror' and 'biteshipmessage' parameters in versions up to, and including, 2.2.24 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

WP-CFM < 1.7.9 - Cross-Site Request Forgery via multiple AJAX functions

Description The WP-CFM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.8. This is due to missing or incorrect nonce validation on multiple AJAX functions. This makes it possible for unauthenticated attackers to modify the plugin's setting...

Setka Editor <= 2.1.20 - Cross-Site Request Forgery via handleRequest

Description The A no-code page builder for beautiful performance-based content plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.20. This is due to missing or incorrect nonce validation on the 'handleRequest' function. This makes it possibl...

cpio backlink vulnerability

cpio is a file backup program for UNIX-like systems. cpio suffers from a backlink vulnerability that stems from the presence of path traversal, which allows an unauthenticated, remote attacker to trick a user into opening a specially crafted archive and then running arbitrary commands on the targ...

Email Before Download <= 6.9.7 - Cross-Site Request Forgery

Description The Email Before Download plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.9.7. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to perform unauthorized actions via a forg...

Page Restrict <= 2.5.5 - Cross-Site Request Forgery via pr_admin_page

Description The Page Restrict plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.5. This is due to missing or incorrect nonce validation on the 'pradminpage' function. This makes it possible for unauthenticated attackers to modify the plugin...

WP Club Manager – WordPress Sports Club Plugin < 2.2.11 - Missing Authorization to Unauthenticated Event Permalink Update

Description The WP Club Manager – WordPress Sports Club Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the settingssave function in all versions up to, and including, 2.2.10. This makes it possible for unauthenticated attackers ...

MultiVendorX Marketplace < 4.0.26 - Missing Authorization

Description The plugin is vulnerable to unauthorized modification of data due to a missing capability check, allowing unauthenticated attackers to call a function that should be accessible to higher users only...

Quicksand Post Filter jQuery Plugin <= 3.1.1 - Cross-Site Request Forgery via renderAdmin

Description The Quicksand Post Filter jQuery Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1.1. This is due to missing or incorrect nonce validation on the 'renderAdmin' function. This makes it possible for unauthenticated attackers to...

Happyforms < 1.25.11 - Missing Authorization

Description The plugin is vulnerable to unauthorized access due to a missing capability check, allowing unauthenticated attackers to perform unauthorized actions...

PowerPack Pro for Elementor < 2.10.8 - Cross-Site Request Forgery to Plugin Settings Modification and Cross-Site Scripting

Description The PowerPack Pro for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions prior to 2.10.8. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to modify plugin settings and inject arbitrary web...

CVE-2024-0909

The Anonymous Restricted Content plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 1.6.2. This is due to insufficient restrictions through the REST API on the posts/pages that protections are being place on. This makes it possible for unauthenticat...

CVE-2024-0909 Anonymous Restricted Content <= 1.6.2 - Protection Mechanism Bypass

The Anonymous Restricted Content plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 1.6.2. This is due to insufficient restrictions through the REST API on the posts/pages that protections are being place on. This makes it possible for unauthenticat...