CVE-2025-49997 WordPress Giveaways and Contests by RafflePress plugin <= 1.12.18 - Broken Access Control + CSRF Vulnerability

Missing Authorization vulnerability in Syed Balkhi Giveaways and Contests by RafflePress rafflepress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Giveaways and Contests by RafflePress: from n/a through = 1.12.18...

CVE-2025-49998 WordPress WooCommerce Fortnox Integration plugin <= 4.5.5 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Wetail WooCommerce Fortnox Integration allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WooCommerce Fortnox Integration: from n/a through 4.5.5...

CVE-2025-50009 WordPress Kata Plus plugin <= 1.5.3 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Climax Themes Kata Plus allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Kata Plus: from n/a through 1.5.3...

CVE-2025-50009

CVE-2025-5009 (Kata Plus) : WordPress Kata Plus add-ons (1.5.3 and earlier) suffer a Missing Authorization/broken access control vulnerability. Root cause is incorrectly configured access control levels allowing unauthorized actions. Affected software: Kata Plus – Addons for Elementor – Widgets, ...

CVE-2025-50008 WordPress WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily plugin <= 1.2.4.5 - Broken Access Control Vulnerability

Missing Authorization vulnerability in cscode WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily innovs-woo-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Manager – Customize and Control...

CVE-2025-50010 WordPress Zapier for WordPress plugin <= 1.5.2 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Zapier Zapier for WordPress zapier allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zapier for WordPress: from n/a through = 1.5.2...

CVE-2025-50034 WordPress Enhanced Blocks – Page Builder Blocks for Gutenberg plugin <= 1.4.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Mahmudul Hasan Arif Enhanced Blocks Page Builder Blocks for Gutenberg enhanced-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Enhanced Blocks Page Builder Blocks for Gutenberg: from n/a through = 1.4.1...

CVE-2025-50034 WordPress Enhanced Blocks – Page Builder Blocks for Gutenberg plugin <= 1.4.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Mahmudul Hasan Arif Enhanced Blocks – Page Builder Blocks for Gutenberg enhanced-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Enhanced Blocks – Page Builder Blocks for Gutenberg: from n/a through = 1.4.1...

CVE-2025-52802 WordPress Import YouTube videos as WP Posts plugin <= 2.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in enguerranws Import YouTube videos as WP Posts import-youtube-videos-as-wp-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Import YouTube videos as WP Posts: from n/a through = 2.1...

WordPress Zara 4 Image Compression plugin <= 1.2.17.2 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Mika in WordPress Plugin Zara 4 Image Compression versions = 1.2.17.2...

WordPress Hello FSE Blog theme <= 1.0.6 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Peter Thaleikis in WordPress Theme Hello FSE Blog versions = 1.0.6...

WordPress eDS Responsive Menu plugin <= 1.2 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Mika in WordPress Plugin eDS Responsive Menu versions = 1.2...

WordPress TM Replace Howdy plugin <= 1.4.2 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Chu The Anh Blue Rock in WordPress Plugin TM Replace Howdy versions = 1.4.2...

WordPress Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes plugin <= 1.0.10 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by ch4r0n in WordPress Plugin Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes versions = 1.0.10...

WordPress UpStream: a Project Management Plugin for WordPress plugin <= 2.1.1 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by domiee13 in WordPress Plugin UpStream: a Project Management Plugin for WordPress versions = 2.1.1...

WordPress WANotifier plugin <= 2.7.12 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nguyen Tran Tuan Dung domiee13 in WordPress Plugin Notifier versions = 2.7.12...

WordPress Media Hygiene plugin <= 4.0.1 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by domiee13 in WordPress Plugin Media Hygiene versions = 4.0.1...

WordPress WP User Profile Avatar plugin <= 1.0.6 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by s1lentmt in WordPress Plugin WP User Profile Avatar versions = 1.0.6...

WordPress User Roles and Capabilities plugin <= 1.2.6 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by domiee13 in WordPress Plugin User Roles and Capabilities versions = 1.2.6...

WordPress WP Customer Area plugin <= 8.3.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nguyen Tran Tuan Dung domiee13 in WordPress Plugin WP Customer Area versions = 8.3.4...