CVE-2023-0405

The GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training WordPress plugin before 1.4.38 does not perform any kind of nonce or privilege checks before letting logged-in users modify arbitrary posts...

WordPress Directorist plugin <= 8.2 - Missing Authorization to Unauthenticated Arbitrary Post Publishing vulnerability

Missing Authorization to Unauthenticated Arbitrary Post Publishing vulnerability discovered by mikemyers in WordPress Plugin Directorist versions = 8.2...

CVE-2025-1463

The Spreadsheet Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.2. This is due to improper nonce validation within the class-wpgsi-show.php script. This makes it possible for unauthenticated attackers to publish arbitrary post...

CVE-2024-12610

The School Management System for Wordpress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'mjsmgtremovefeetype' and 'mjsmgtremovecategorynew' AJAX actions in all versions up to, and including, 93.0.0. This makes it possible for...

CVE-2025-1463

The Spreadsheet Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.2. This is due to improper nonce validation within the class-wpgsi-show.php script. This makes it possible for unauthenticated attackers to publish arbitrary post...

CVE-2025-1463

CVE-2025-1463 affects Spreadsheet Integration (WordPress plugin) up to version 3.8.2. Root cause: improper nonce validation in class-wpgsi-show.php leading to Cross-Site Request Forgery. Impact: unauthenticated attackers can publish arbitrary posts (including private ones) if a site admin is tric...

WordPress plugin Spreadsheet Integration 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site request forge...

WordPress plugin Rank Math SEO 访问控制错误漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An access control error...

WordPress plugin aDirectory 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2024-8476

The Easy PayPal Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the wpeeventpluginbuttons function. This makes it possible for unauthenticated attackers to delete arbitrary...

CVE-2024-8476

CVE-2024-8476 affects the Easy PayPal Events plugin for WordPress (versions

Improper Access Control

github.com/mattermost/mattermost-server is vulnerable to Improper Access Control. The vulnerability is due to inadequate validation when shared channels are enabled, allowing an attacker to create, update, or delete arbitrary posts in arbitrary channels...

CVE-2024-41144 Malicious remote can create/update/delete arbitrary posts in arbitrary channels

Mattermost versions 9.9.x = 9.9.0, 9.5.x = 9.5.6, 9.7.x = 9.7.5, 9.8.x = 9.8.1 fail to properly validate synced posts, when shared channels are enabled, which allows a malicious remote to create/update/delete arbitrary posts in arbitrary channels...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A security vulnerability exists in Mattermost that stems from a failure to properly validate synchronized posts when shared channels are enabled, which allows a malicious remote user to...

CVE-2024-6755

The CVE-2024-6755 entry concerns the WordPress Social Auto Poster plugin (versions up to and including 5.3.14) suffering from a missing capability check in wpw_auto_poster_quick_delete_multiple, enabling unauthenticated actors to delete arbitrary posts. The connected data corroborates the root ca...

WordPress Social Auto Poster plugin <= 5.3.14 - Missing Authorization to Unauthenticated Arbitrary Post Deletion vulnerability

Missing Authorization to Unauthenticated Arbitrary Post Deletion vulnerability discovered by István Márton in WordPress Plugin Social Auto Poster versions = 5.3.14...

CVE-2024-5977

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.13.0 via the 'handleRequest' function due to missing validation on a user controlled key. This makes it possible for authenticated...

CVE-2024-5977

CVE-2024-5977 affects GiveWP – Donation Plugin and Fundraising Platform for WordPress. The vulnerability is an Insecure Direct Object Reference (IDOR) in the handleRequest path, with missing validation on a user-controlled key, enabling authenticated users with GiveWP Worker-level access and abov...

PT-2024-37288 · WordPress · Givewp

Name of the Vulnerable Software and Affected Versions: GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress versions up to, and including, 3.13.0 Description: The issue is related to Insecure Direct Object Reference, which occurs due to missing validation on a user-controlled ke...

CVE-2024-5545 Motors – Car Dealer, Classifieds & Listing <= 1.4.9 - Missing Authorization

The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the stmeditdeleteusercar function in all versions up to, and including, 1.4.8. This makes it possible for unauthenticated attackers to...