CVE-2025-49969 WordPress Zara 4 Image Compression plugin <= 1.2.17.2 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Zara 4 Zara 4 Image Compression zara-4 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zara 4 Image Compression: from n/a through = 1.2.17.2...

CVE-2025-49974

CVE-2025-49974 describes a Missing/Misconfigured Authorization vulnerability in UpStream: a Project Management Plugin for WordPress. Affected software: UpStream versions up to and including 2.1.0. Root cause: broken/missing access control, allowing unauthorized access due to incorrectly configure...

CVE-2025-49976

CVE-2025-49976 concerns the WANotifier WordPress plugin (versions

CVE-2025-49980 WordPress WP User Profile Avatar plugin <= 1.0.6 - Broken Access Control Vulnerability

Missing Authorization vulnerability in WP Event Manager WP User Profile Avatar allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP User Profile Avatar: from n/a through 1.0.6...

CVE-2025-49981 WordPress User Roles and Capabilities plugin <= 1.2.6 - Broken Access Control Vulnerability

Missing Authorization vulnerability in mahabub81 User Roles and Capabilities user-roles-and-capabilities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Roles and Capabilities: from n/a through = 1.2.6...

CVE-2025-49987 WordPress CRM ERP Business Solution plugin <= 1.13 - Broken Access Control Vulnerability

Missing Authorization vulnerability in WPFactory CRM ERP Business Solution allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects CRM ERP Business Solution: from n/a through 1.13...

CVE-2025-49988 WordPress Contact Form 7 AWeber Extension plugin <= 0.1.40 - Broken Access Control vulnerability

Missing Authorization vulnerability in Renzo Johnson Contact Form 7 AWeber Extension integrate-contact-form-7-and-aweber allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form 7 AWeber Extension: from n/a through = 0.1.40...

CVE-2025-49990

CVE-2025-49990 concerns the WordPress ContentStudio plugin. All connected documents describe a Missing Authorization / Broken Access Control vulnerability in ContentStudio, enabling access to functionality not properly constrained by ACLs. Publicly disclosed details indicate affected versions inc...

CVE-2025-49989

CVE-2025-49989 refers to a Missing Authorization (Broken Access Control) vulnerability in the WordPress App Builder plugin, affecting versions up to 5.5.3. The issue arises from improperly configured access control/security levels, enabling an attacker to bypass authorization. Public sources corr...

CVE-2025-49991

CVE-2025-49991 is a Missing Authorization/broken access control vulnerability in the WordPress plugin WP-Recall (versions up to and including 16.26.14). The issue permits accessing functionality not properly constrained by ACLs. Public details confirm WP-Recall versions before 16.26.14 are affect...

CVE-2025-50008 WordPress WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily plugin <= 1.2.4.5 - Broken Access Control Vulnerability

Missing Authorization vulnerability in cscode WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily innovs-woo-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Manager – Customize and Control...

CVE-2025-50010 WordPress Zapier for WordPress plugin <= 1.5.2 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Zapier Zapier for WordPress zapier allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zapier for WordPress: from n/a through = 1.5.2...

PT-2025-26355 · Wpfactory · Wpfactory Crm Erp Business Solution

Name of the Vulnerable Software and Affected Versions: WPFactory CRM ERP Business Solution versions 1.13 and earlier Description: The issue is related to a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. Recommendations: For...

PT-2025-26364 · Woocommerce · Wetail Woocommerce Fortnox Integration

Name of the Vulnerable Software and Affected Versions: Wetail WooCommerce Fortnox Integration versions through 4.5.5 Description: The issue is related to a Missing Authorization vulnerability, allowing the exploitation of incorrectly configured access control security levels. Recommendations: For...

PT-2025-26356 · Unknown · Renzo Contact Form 7 Aweber Extension

Name of the Vulnerable Software and Affected Versions: Renzo Contact Form 7 AWeber Extension versions 0.1.38 and earlier Description: The issue is related to a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. Recommendations: For...

PT-2025-26339 · Unknown · Athemeart Translations Eds Responsive Menu

Name of the Vulnerable Software and Affected Versions: aThemeArt Translations eDS Responsive Menu versions 1.2 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: Fo...

CVE-2025-49857

Missing Authorization vulnerability in Saad Iqbal myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through = 2.9.4.2...

CVE-2025-49864 WordPress AFS Analytics plugin <= 4.21 - Broken Access Control Vulnerability

Missing Authorization vulnerability in AFS Analytics AFS Analytics allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects AFS Analytics: from n/a through 4.21...

CVE-2025-49872

CVE-2025-49872 is a Missing Authorization (Broken Access Control) vulnerability affecting the WordPress plugin myCred (versions up to and including 2.9.4.2). The advisory states that functionality is accessible without proper ACL enforcement, enabling access to restricted features. The CVSS v3.1 ...

CVE-2025-49874 WordPress Arconix FAQ plugin <= 1.9.6 - Broken Access Control Vulnerability

Missing Authorization vulnerability in tychesoftwares Arconix FAQ allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Arconix FAQ: from n/a through 1.9.6...