CVE-2024-11205 WPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation

The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpformsisadminpage' function in versions starting from 1.8.4 up to, and including, 1.9.2.1. This makes it possible for authenticated attackers, with Subscriber-level acces...

CVE-2024-11205 WPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation

The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpformsisadminpage' function in versions starting from 1.8.4 up to, and including, 1.9.2.1. This makes it possible for authenticated attackers, with Subscriber-level acces...

PT-2024-36981

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.12.0-rc6-00077-g2e1b3cc9d7f7 Description A problem in the Linux kernel has been fixed, specifically with the vGPIO driver, which would crash during bootup. The crash was caused by an unauthorized modification o...

CVE-2024-7894

The If Menu plugin for WordPress is vulnerable to unauthorized modification of the plugin's license key due to a missing capability check on the 'actions' function in versions up to, and including, 0.19.1. This makes it possible for unauthenticated attackers to modify delete or modify the license...

CVE-2024-7894 If Menu <= 0.19.1 - Missing Authorization to License Key Update

The If Menu plugin for WordPress is vulnerable to unauthorized modification of the plugin's license key due to a missing capability check on the 'actions' function in versions up to, and including, 0.19.1. This makes it possible for unauthenticated attackers to modify delete or modify the license...

CVE-2024-7894

CVE-2024-7894 describes a vulnerability in the WordPress If Menu plugin (versions up to and including 0.19.1) where missing capability checks in the actions function allow unauthenticated attackers to modify the plugin license key. The vulnerability has been observed in multiple feeds (NVD/Red Ha...

CVE-2024-11353

CVE-2024-11353 affects the WordPress plugin SMS for Lead Capture Forms (ClickSend Lead Capture Form). The vulnerability is a missing capability check in the delete_message() function across all versions up to 1.1.0, allowing authenticated attackers with Subscriber+ privileges to perform unauthori...

CVE-2024-12026 Message Filter for Contact Form 7 <= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) New Filter Creation

The Message Filter for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveFilter function in all versions up to, and including, 1.6.3. This makes it possible for authenticated attackers, with Subscriber-level access...

CVE-2024-9706

The Ultimate Coming Soon & Maintenance plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ucsmactivatelitetemplatelite function in all versions up to, and including, 1.0.9. This makes it possible for unauthenticated attackers to change...

CVE-2024-9705

The Ultimate Coming Soon & Maintenance plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ucsmupdatetemplatenamelite' function in all versions up to, and including, 1.0.9. This makes it possible for authenticated attackers, with...

CVE-2024-12110

The Gold Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the activate and deactivate functions in all versions up to, and including, 1.3.2. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2024-12155

The SV100 Companion plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the settingsimport function in all versions up to, and including, 2.0.02. This makes it possible for unauthenticated attackers to...

CVE-2024-12027

The Message Filter for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the updateFilter and deleteFilter functions in all versions up to, and including, 1.6.3. This makes it possible for authenticated attackers, with...

CVE-2024-11323

The AI Quiz | Quiz Maker plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the aiquizupdatestyle function in all versions up to, and including, 1.1. This makes it possible for authenticated attackers,...

CVE-2024-12155 SV100 Companion <= 2.0.02 - Missing Authorization to Unuathenticated Arbitrary Options Update

The SV100 Companion plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the settingsimport function in all versions up to, and including, 2.0.02. This makes it possible for unauthenticated attackers to...

CVE-2024-12155 SV100 Companion <= 2.0.02 - Missing Authorization to Unuathenticated Arbitrary Options Update

The SV100 Companion plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the settingsimport function in all versions up to, and including, 2.0.02. This makes it possible for unauthenticated attackers to...

CVE-2024-9706 Ultimate Coming Soon & Maintenance <= 1.0.9 - Missing Authorization to Unauthenticated Template Activation

The Ultimate Coming Soon & Maintenance plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ucsmactivatelitetemplatelite function in all versions up to, and including, 1.0.9. This makes it possible for unauthenticated attackers to change...

CVE-2024-9706 Ultimate Coming Soon & Maintenance <= 1.0.9 - Missing Authorization to Unauthenticated Template Activation

The Ultimate Coming Soon & Maintenance plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ucsmactivatelitetemplatelite function in all versions up to, and including, 1.0.9. This makes it possible for unauthenticated attackers to change...

CVE-2024-9706

CVE-2024-9706 affects the WordPress plugin “Ultimate Coming Soon & Maintenance” (≤1.0.9). The root cause is a missing capability check in the function ucsm_activate_lite_template_lite, allowing unauthenticated attackers to modify the coming-soon/maintenance page template. Public references confir...

CVE-2024-9872

CVE-2024-9872 (vcita WordPress plugin) : Affected plugin versions include all up to 4.5.1. Root cause is a missing capability check in vcita_save_user_data_callback(), enabling authenticated users with Subscriber+ privileges to modify data and inject scripts and update settings. Impact per source...