WordPress Eventer plugin <= 3.9.9 - Missing Authorization to Authenticated (Subscriber+) Bookings Export

Missing Authorization to Authenticated Subscriber+ Bookings Export vulnerability discovered by István Márton in WordPress Plugin Eventer versions = 3.9.9...

WordPress Food Menu plugin <= 5.1.4 - Missing Authorization to Authenticated (Subscriber+) Settings Update vulnerability

Missing Authorization to Authenticated Subscriber+ Settings Update vulnerability discovered by abrahack in WordPress Plugin Food Menu – Restaurant Menu & Online Ordering for WooCommerce versions = 5.1.4...

WordPress Ni Sales Commission For WooCommerce plugin <= 1.2.4 - Missing Authorization to Authenticated (Subscriber+) Commission Update vulnerability

Missing Authorization to Authenticated Subscriber+ Commission Update vulnerability discovered by SOPROBRO in WordPress Plugin Ni Sales Commission For WooCommerce versions = 1.2.4...

WordPress Single-user-chat plugin <= 0.5 - Authenticated (Subscriber+) Limited Options Update vulnerability

Authenticated Subscriber+ Limited Options Update vulnerability discovered by Colin Xu in WordPress Plugin Single-user-chat versions = 0.5...

WordPress Royal Core plugin <= 2.9.2 - Authenticated (Subscriber+) Arbitrary Options Update vulnerability

Authenticated Subscriber+ Arbitrary Options Update vulnerability discovered by Tonn in WordPress Plugin Royal Core versions = 2.9.2...

WordPress Zox News plugin <= 3.16.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Options Update vulnerability discovered by Tonn in WordPress Theme Zox News versions = 3.16.0...

WordPress Youzify plugin <= 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update vulnerability

Missing Authorization to Authenticated Subscriber+ Limited Options Update vulnerability discovered by Stiofan in WordPress Plugin Youzify versions = 1.3.4...

WordPress WP Hotel Booking plugin <= 2.1.6 - Missing Authorization to Authenticated (Subscriber+) User Email Retrieval vulnerability

Missing Authorization to Authenticated Subscriber+ User Email Retrieval vulnerability discovered by Krzysztof Zając in WordPress Plugin WP Hotel Booking versions = 2.1.6...

WordPress AI Power: Complete AI Pack plugin <= 1.8.96 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Shortcode Execution vulnerability discovered by mikemyers in WordPress Plugin GPT3 AI Content Writer versions = 1.8.96...

WordPress Buzz Club Theme plugin <= 2.0.4 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Option Update vulnerability

Missing Authorization to Authenticated Subscriber+ Limited Arbitrary Option Update vulnerability discovered by Lucio Sá in WordPress Theme Buzz Club versions = 2.0.4...

WordPress Sandbox plugin <= 0.4 - Missing Authorization to Authenticated (Subscriber+) Sandbox Download vulnerability

Missing Authorization to Authenticated Subscriber+ Sandbox Download vulnerability discovered by Stiofan in WordPress Theme Sandbox versions = 0.4...

WordPress Passwords Manager plugin <= 1.4.8 - Missing Authorization to Authenticated (Subscriber+) Add Password + Update Encryption Key vulnerability

Missing Authorization to Authenticated Subscriber+ Add Password + Update Encryption Key vulnerability discovered by Lucio Sá in WordPress Plugin Passwords Manager versions = 1.4.8...

WordPress NitroPack plugin <= 1.17.0 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update vulnerability

Missing Authorization to Authenticated Subscriber+ Limited Options Update vulnerability discovered by Sean Murphy in WordPress Plugin NitroPack versions = 1.17.0...

CVE-2024-6155

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Authenticated Subscriber+ Server-Side Request Forgery and Stored Cross Site Scripting in all versions up to, and including, 9.0.0 due to a missing capability check in the greenshiftdownloadfilelocaly function...

WordPress GS Insever Portfolio plugin <= 1.4.5 - Missing Authorization to Authenticated (Subscriber+) CSS Injection vulnerability

Missing Authorization to Authenticated Subscriber+ CSS Injection vulnerability discovered by Peter Thaleikis in WordPress Plugin GS Insever Portfolio versions = 1.4.5...

CVE-2024-11270

The WordPress Webinar Plugin – WebinarPress plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check on the 'sync-import-imgs' function and missing file type validation in all versions up to, and including, 1.33.24. This makes it possible for authenticated...

PT-2025-1714 · WordPress · Wp Extended

Name of the Vulnerable Software and Affected Versions: The Ultimate WordPress Toolkit – WP Extended plugin for WordPress versions up to, and including, 3.0.11 Description: The issue is related to a missing capability check on several functions, allowing authenticated attackers with subscriber-lev...

WordPress WP Job Portal plugin <= 2.2.5- Authenticated (Subscriber+) Insecure Direct Object Reference vulnerability

WordPress WP Job Portal plugin = 2.2.5- Authenticated Subscriber+ Insecure Direct Object Reference vulnerability discovered by Apostolos Sakellariou in WordPress Plugin WP Job Portal versions = 2.2.5...

WordPress SMS Alert Order Notifications – WooCommerce plugin <= 3.7.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Options Update vulnerability discovered by 1337Wannabe in WordPress Plugin SMS Alert Order Notifications versions = 3.7.6...

WordPress Aurum theme <= 4.0.2 - Missing Authorization to Authenticated (Subscriber+) Demo Content Import vulnerability

Missing Authorization to Authenticated Subscriber+ Demo Content Import vulnerability discovered by Lucio Sá in WordPress Theme Aurum versions = 4.0.2...