EUVD-2016-1921

Malware in sbrugna...

CVE-2020-36840

The vulnerability CVE-2020-36840 affects the WordPress plugin Timetable and Event Schedule by MotoPress (versions up to 2.3.8). It is an authorization bypass caused by a missing capability check on the wp_ajax_route_url() function invoked via a nopriv AJAX action. This allows unauthenticated atta...

Multivendor Marketplace Solution for WooCommerce < 3.8.12 - Unauthorised AJAX Calls

The plugin is lacking authorisation and CSRF in multiple AJAX actions, which could allow any authenticated users, such as subscriber to call them and suspend vendors reporter by the submitter or update arbitrary order status identified by WPScan when verifying the issue for example. Other...