CVE-2025-2539

The File Away plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax function in all versions up to, and including, 3.9.9.0.1. This makes it possible for unauthenticated attackers, leveraging the use of a reversible weak algorithm, to read...

PT-2025-12329 · WordPress · File Away

Name of the Vulnerable Software and Affected Versions: File Away plugin for WordPress versions up to, and including, 3.9.9.0.1 Description: The issue is related to unauthorized access of data due to a missing capability check on the ajax function. This allows unauthenticated attackers to read the...

CVE-2025-2539: Use of a Broken or Risky Cryptographic Algorithm

The File Away plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax function in all versions up to, and including, 3.9.9.0.1. This makes it possible for unauthenticated attackers, leveraging the use of a reversible weak algorithm, to read...

PT-2025-11667

Name of the Vulnerable Software and Affected Versions CozyStay versions 1.7.0 and earlier TinySalt versions 3.9.0 and earlier Description The issue affects the CozyStay and TinySalt plugins for WordPress, allowing unauthenticated attackers to inject a PHP object through deserialization of untrust...

WordPress plugin CozyStay and WordPress plugin TinySalt have code vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

WordPress plugin CozyStay has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2025-11668

Name of the Vulnerable Software and Affected Versions CozyStay theme for WordPress versions up to, and including, 1.7.0 Description The CozyStay theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax handler function. This makes it...

PT-2025-11657

Name of the Vulnerable Software and Affected Versions BoomBox Theme Extensions plugin for WordPress versions up to, and including, 1.8.0 Description The BoomBox Theme Extensions plugin for WordPress is vulnerable to privilege escalation via account takeover. This is due to the plugin not properly...

CVE-2025-2290: Missing Authorization

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Unauthenticated Post Trashing due to a missing capability check on the deleteaccessplan function and the related AJAX calls in all versions up to, and including, 8.0.1. This makes it possible for...

WordPress CozyStay theme <= 1.7.0 - Missing Authorization to Arbitrary Action Execution in ajax_handler vulnerability

Missing Authorization to Arbitrary Action Execution in ajaxhandler vulnerability discovered by Lucio Sá in WordPress Theme CozyStay versions = 1.7.0...

Xinhu RockOA security vulnerability

Xinhu RockOA is an office OA system of China Xinhu Xinhu Company. A security vulnerability exists in Xinhu RockOA 2.6.5 and earlier versions, which originates from the inputAction.php file and the saveAjax function that allows SQL injection, which may result in the execution of arbitrary code...

CVE-2025-2199

CVE-2025-2199 describes an SQL injection vulnerability in the Innovación y Cualificación local administration plugin ajax.php. The flaw allows an attacker to inject SQL via multiple parameters (searchActionsToUpdate, searchSpecialitiesPending, searchSpecialitiesLinked, searchUsersToUpdateProfile,...

CVE-2025-2289

The Zegen - Church WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX endpoints in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to impor...

CVE-2025-0952

The Eco Nature - Environment & Ecology WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'cmsmastershideadminnotice' AJAX action in all versions up to, and including, 2.0.4. This mak...

CVE-2025-1653 Directory Listings WordPress plugin – uListing <= 2.2.0 - Authenticated (Subscriber+) Privilege Escalation

The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.2.0. This is due to the stmlistingprofileedit AJAX action not having enough restriction on the user meta that can be updated. This makes it possibl...

CVE-2025-28937

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in lavacode Lava Ajax Search lava-ajax-search allows Stored XSS.This issue affects Lava Ajax Search: from n/a through = 1.1.9...

CVE-2025-2289

The Zegen - Church WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX endpoints in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to impor...

CVE-2025-2289

The Zegen - Church WordPress Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX endpoints in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to impor...

CVE-2025-0952

CVE-2025-0952 affects the Eco Nature - Environment & Ecology WordPress Theme. A missing capability check on the cmsmasters_hide_admin_notice AJAX action in all versions up to 2.0.4 allows authenticated users with Subscriber+ access to modify options (e.g., setting hide) and potentially cause a de...

CVE-2025-2289

CVE-2025-2289 (Zegen - Church WordPress Theme) affects the WordPress theme Zegen up to version 1.1.9. The vulnerability is caused by a missing capability check on several AJAX endpoints, allowing authenticated attackers with Subscriber-level access and above to import, export, and update theme op...