CVE-2025-22720

CVE-2025-22720 corresponds to a Missing Authorization vulnerability in MagePeople Team Booking and Rental Manager (WordPress plugin) affecting versions up to 2.2.1. The issue stems from incorrectly configured access control, enabling bypass of authorization. CVSS v3.1 base score is 5.8 (Scope: Ch...

CVE-2025-22265

CVE-2025-22265 is a Missing Authorization vulnerability affecting mgplugin EMI Calculator (WordPress plugin). The connected Red Hat and PT Security sources specify a misconfiguration of access controls (Incorrectly Configured Access Control Security Levels) that enables exploitation due to insuff...

CVE-2024-13717

CVE-2024-13717 affects the WordPress plugin Contact Form and Calls To Action by vcita, up to and including version 2.7.1. The flaw is a missing capability check in the vcita_ajax_toggle_ae and vcita_ajax_toggle_contact functions, allowing authenticated attackers with subscriber-level access and a...

CVE-2025-24603

Missing Authorization vulnerability in Dmitry V. CEO of "UKR Solution" Print Barcode Labels for your WooCommerce products/orders a4-barcode-generator.This issue affects Print Barcode Labels for your WooCommerce products/orders: from n/a through = 3.4.10...

CVE-2025-24747

CVE-2025-24747 describes a missing authorization vulnerability in the Houzez WordPress theme (affected: v1.x through 3.4.0). The Red Hat and CVE-Listing entries identify it as a Missing Authorization / Broken Access Control issue affecting Houzez up to version 3.4.0. The vulnerability is technica...

CVE-2025-24653 WordPress Admin and Site Enhancements (ASE) Pro Plugin <= 7.6.1.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in NotFound Admin and Site Enhancements ASE Pro allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Admin and Site Enhancements ASE Pro: from n/a through 7.6.1.1...

PT-2025-5476 · Unknown · Admin/Site Enhancements (Ase) Pro

Name of the Vulnerable Software and Affected Versions: Admin and Site Enhancements ASE Pro versions n/a through 7.6.1.1 Description: The issue is related to a lack of authorization in Admin and Site Enhancements ASE Pro, which allows the exploitation of incorrectly configured access control...

PT-2025-5427 · Haptiq · Picu – Online Photo Proofing Gallery

Name of the Vulnerable Software and Affected Versions: picu – Online Photo Proofing Gallery versions prior to 2.4.0 Description: The issue is related to a lack of authorization in Haptiq picu – Online Photo Proofing Gallery, which allows the exploitation of incorrectly configured access control...

CVE-2025-24736 WordPress Post Duplicator plugin <= 2.35 - Broken Access Control vulnerability

Missing Authorization vulnerability in metaphorcreations Post Duplicator post-duplicator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Duplicator: from n/a through = 2.35...

CVE-2025-24682 WordPress Super Block Slider plugin <= 2.7.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in mikemmx Super Block Slider allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Super Block Slider: from n/a through 2.7.9...

CVE-2025-24633 WordPress Build Private Store For Woocommerce plugin <= 1.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in silverplugins217 Build Private Store For Woocommerce build-private-store-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Build Private Store For Woocommerce: from n/a through = 1.0...

CVE-2025-24588 WordPress Patreon WordPress plugin <= 1.9.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in patreon Patreon WordPress patreon-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Patreon WordPress: from n/a through = 1.9.1...

CVE-2025-24588 WordPress Patreon WordPress plugin <= 1.9.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in patreon Patreon WordPress patreon-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Patreon WordPress: from n/a through = 1.9.1...

CVE-2025-24580 WordPress 12 Step Meeting List plugin <= 3.16.5 - Arbitrary Content Deletion vulnerability

Missing Authorization vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 12 Step Meeting List: from n/a through = 3.16.5...

CVE-2025-24580 WordPress 12 Step Meeting List plugin <= 3.16.5 - Arbitrary Content Deletion vulnerability

Missing Authorization vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 12 Step Meeting List: from n/a through = 3.16.5...

CVE-2025-22609

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to attach any existing private key on a coolify instance to his own server. If the server configuration of I...

CVE-2025-22610

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to fetch the global coolify instance OAuth configuration. This exposes the "client id" and "client secret" f...

CVE-2025-22610 Coolify Vulnerable to OAuth Secrets Leak

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to fetch the global coolify instance OAuth configuration. This exposes the "client id" and "client secret" f...

CVE-2025-22608 Coolify Vulnerable to Revocation of Arbitrary Team Invitations (DOS)

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to revoke any team invitations on a Coolify instance by only providing a predictable and incrementing ID,...

CVE-2025-23991 WordPress Product Size Charts Plugin for WooCommerce plugin <= 2.4.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in Dotstore Product Size Charts Plugin for WooCommerce woo-advanced-product-size-chart.This issue affects Product Size Charts Plugin for WooCommerce: from n/a through = 2.4.5...