WordPress Classified Listing plugin <= 5.2.0 - Missing Authorization to Authenticated (Subscriber+) Listing Types Tampering vulnerability

Missing Authorization to Authenticated Subscriber+ Listing Types Tampering vulnerability discovered by Rafshanzani Suhada in WordPress Plugin Classified Listing versions = 5.2.0...

WordPress Hydra Booking plugin <= 1.1.27 - Unauthenticated Arbitrary Booking Cancellation via Weak Hash Generation vulnerability

Unauthenticated Arbitrary Booking Cancellation via Weak Hash Generation vulnerability discovered by Ahmad Salem a7mad.cc in WordPress Plugin Hydra Booking versions = 1.1.27...

WordPress Ninja Countdown plugin <= 1.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Countdown Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Countdown Deletion vulnerability discovered by Ivan Cese in WordPress Plugin Ninja Countdown versions = 1.5.0...

WordPress Envira Photo Gallery plugin <= 1.11.0 - Missing Authorization to Authenticated (Contributor+) Gallery Conversion vulnerability

Missing Authorization to Authenticated Contributor+ Gallery Conversion vulnerability discovered by Lucas Montes Nirox in WordPress Plugin Envira Photo Gallery versions = 1.11.0...

WordPress Flexible Refund and Return Order for WooCommerce plugin <= 1.0.42 - Incorrect Authorization to Authenticated (Contributor+) Refund Status Update vulnerability

Incorrect Authorization to Authenticated Contributor+ Refund Status Update vulnerability discovered by Powpy in WordPress Plugin Flexible Refund and Return Order for WooCommerce versions = 1.0.42...

WordPress EventPrime plugin <= 4.2.0.0 - Missing Authorization to Authenticated (Subscriber+) Booking Note Creation vulnerability

Missing Authorization to Authenticated Subscriber+ Booking Note Creation vulnerability discovered by Brian Mungai in WordPress Plugin EventPrime versions = 4.2.0.0...

WordPress Ovatheme Events Manager plugin <= 1.8.6 - Missing Authorization vulnerability

Missing Authorization vulnerability discovered by Foxyyy in WordPress Plugin Ovatheme Events Manager versions = 1.8.6...

WordPress Contact Form 7 AWeber Extension plugin <= 0.1.42 - Missing Authorization to Authenticated (Subscriber+) Log Reset vulnerability

Missing Authorization to Authenticated Subscriber+ Log Reset vulnerability discovered by Legion Hunter in WordPress Plugin Contact Form 7 AWeber Extension versions = 0.1.42...

WordPress Download Manager plugin <= 3.3.30 - Unauthenticated Cron Trigger due to Hardcoded Cron Key vulnerability

Unauthenticated Cron Trigger due to Hardcoded Cron Key vulnerability discovered by Jack Pas Dark. - Black Lantern Security in WordPress Plugin Download Manager versions = 3.3.30...

WordPress WPFunnels plugin <= 3.6.2 - Unauthorized User Registration vulnerability

Unauthorized User Registration vulnerability discovered by Ahmed Rayen Ayari in WordPress Plugin WPFunnels versions = 3.6.2...

WordPress Seriously Simple Podcasting plugin <= 3.13.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by daroo in WordPress Plugin Seriously Simple Podcasting versions = 3.13.0...

WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Client Invoicing by Sprout Invoices versions = 20.8.7...

WordPress WP Delicious plugin <= 1.9.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by theviper17 in WordPress Plugin WP Delicious versions = 1.9.1...

WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.0.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions = 4.0.3...

WordPress Login Page Customizer – Customizer Login Page, Admin Page, Custom Design plugin <= 2.1.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin Login Page Customizer Customizer Login Page, Admin Page, Custom Design versions = 2.1.1...

WordPress ZoloBlocks plugin <= 2.3.11 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Que Thanh Tuan - Blue Rock in WordPress Plugin ZoloBlocks versions = 2.3.11...

WordPress Page & Post Notes plugin <= 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Note Update/Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Note Update/Deletion vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin Page & Post Notes versions = 1.3.4...

WordPress IDonate plugin 2.0.0 - 2.1.9 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Deletion via admin_post_donor_delete Function vulnerability

WordPress IDonate plugin 2.0.0 - 2.1.9 - Insecure Direct Object Reference to Authenticated Subscriber+ Arbitrary User Deletion via adminpostdonordelete Function vulnerability discovered by kr0d in WordPress Plugin IDonate versions 2.0.0-2.1.9...

WordPress Elementinvader Addons for Elementor plugin < 1.4.1 – Unauthenticated Arbitrary Email Sending vulnerability

Unauthenticated Arbitrary Email Sending vulnerability discovered by Lucas Montes in WordPress Plugin ElementInvader Addons for Elementor versions 1.4.1...

CVE-2025-62914 WordPress Effect Maker plugin <= 1.2.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in anibalwainstein Effect Maker effect-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Effect Maker: from n/a through = 1.2.1...