WordPress Listar – Directory Listing & Classifieds WordPress Plugin plugin <= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Post Deletion vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin Listar – Directory Listing & Classifieds versions = 3.0.0...

WordPress WP-CRM System plugin <= 3.4.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin WP-CRM System versions = 3.4.6...

WordPress IDonate plugin <= 2.1.15 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Tarcísio LuchesiPoystick in WordPress Plugin IDonate versions = 2.1.15...

WordPress Yandex.Metrica plugin <= 1.2.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by ohmymex in WordPress Plugin Yandex.Metrica versions = 1.2.2...

WordPress Post SMTP plugin <= 3.6.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Post SMTP versions = 3.6.1...

WordPress Actionwear products sync plugin <= 2.3.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Jarno Vos jrn5151 in WordPress Plugin Actionwear products sync versions = 2.3.3...

WordPress Gravitec.net – Web Push Notifications plugin <= 2.9.17 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin Gravitec.net Web Push Notifications versions = 2.9.17...

WordPress Ergonet Cache plugin <= 1.0.13 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin Ergonet Cache versions = 1.0.13...

WordPress My Tickets plugin <= 2.1.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by daroo in WordPress Plugin My Tickets versions = 2.1.0...

WordPress WPKoi Templates for Elementor plugin <= 3.4.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by benzdeus in WordPress Plugin WPKoi Templates for Elementor versions = 3.4.4...

WordPress g-FFL Cockpit plugin <= 1.7.1 - Improper Authorization to Unauthenticated Product Deletion vulnerability

Improper Authorization to Unauthenticated Product Deletion vulnerability discovered by Ryan Kozak in WordPress Plugin g-FFL Cockpit versions = 1.7.1...

WordPress Listar – Directory Listing & Classifieds WordPress plugin plugin <= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) Listing Update vulnerability

Missing Authorization to Authenticated Subscriber+ Listing Update vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin Listar – Directory Listing & Classifieds versions = 3.0.0...

WordPress Search, Filters & Merchandising for WooCommerce plugin <= 3.0.63 - Missing Authorization to Authenticated (Subscriber+) plugin Deactivation vulnerability

Missing Authorization to Authenticated Subscriber+ plugin Deactivation vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin Search, Filters & Merchandising for WooCommerce versions = 3.0.63...

WordPress weDocs plugin <= 2.1.14 - Missing Authorization to Settings Update vulnerability

Missing Authorization to Settings Update vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan - Knight Squad in WordPress Plugin weDocs versions = 2.1.14...

CVE-2025-13932

The SolisCloud API suffers from a Broken Access Control vulnerability, specifically an Insecure Direct Object Reference IDOR, where any authenticated user can access detailed data of any plant by altering the plantid in the request...

WordPress Post Cloner plugin <= 1.0.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin Post Cloner versions = 1.0.0...

WordPress SMS Alert Order Notifications plugin <= 3.8.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by benzdeus in WordPress Plugin SMS Alert Order Notifications versions = 3.8.8...

WordPress Tablesome plugin <= 1.1.34 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Certus Cybersecurity in WordPress Plugin Tablesome versions = 1.1.34...

WordPress Constant Contact + WooCommerce plugin <= 2.4.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Constant Contact + WooCommerce versions = 2.4.1...

WordPress Custom Layouts – Post + Product grids made easy plugin <= 1.4.12 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by daroo in WordPress Plugin Custom Layouts – Post + Product grids made easy versions = 1.4.12...