CVE-2025-49993

CVE-2025-49993 covers a Missing Authorization vulnerability in the WordPress Cookie-Script.com plugin (versions ≤ 1.2.1). Attack surface is the plugin’s access control configuration, described as “Broken/Incorrectly Configured Access Control,” enabling exploitation of insufficient authorization c...

CVE-2025-49991 WordPress WP-Recall plugin <= 16.26.14 - Broken Access Control Vulnerability

Missing Authorization vulnerability in tggfref WP-Recall allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects WP-Recall: from n/a through 16.26.14...

CVE-2025-49996 WordPress WP Visitor Statistics (Real Time Traffic) plugin <= 8.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in osama.esh WP Visitor Statistics Real Time Traffic wp-stats-manager allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Visitor Statistics Real Time Traffic: from n/a through = 8.4...

CVE-2025-49996 WordPress WP Visitor Statistics (Real Time Traffic) plugin <= 8.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in osama.esh WP Visitor Statistics Real Time Traffic wp-stats-manager allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Visitor Statistics Real Time Traffic: from n/a through = 8.4...

CVE-2025-49997

CVE-2025-49997 (Giveaways and Contests by RafflePress) is a Missing Authorization issue in the WordPress plugin Giveaways and Contests by RafflePress, affecting version 1.12.17 and earlier. The advisory notes that access to functionality is not properly constrained by ACLs. Related feeds indicate...

CVE-2025-49997 WordPress Giveaways and Contests by RafflePress plugin <= 1.12.18 - Broken Access Control + CSRF Vulnerability

Missing Authorization vulnerability in Syed Balkhi Giveaways and Contests by RafflePress rafflepress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Giveaways and Contests by RafflePress: from n/a through = 1.12.18...

CVE-2025-49998 WordPress WooCommerce Fortnox Integration plugin <= 4.5.5 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Wetail WooCommerce Fortnox Integration allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WooCommerce Fortnox Integration: from n/a through 4.5.5...

CVE-2025-50009 WordPress Kata Plus plugin <= 1.5.3 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Climax Themes Kata Plus allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Kata Plus: from n/a through 1.5.3...

CVE-2025-50009

CVE-2025-5009 (Kata Plus) : WordPress Kata Plus add-ons (1.5.3 and earlier) suffer a Missing Authorization/broken access control vulnerability. Root cause is incorrectly configured access control levels allowing unauthorized actions. Affected software: Kata Plus – Addons for Elementor – Widgets, ...

CVE-2025-50008 WordPress WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily plugin <= 1.2.4.5 - Broken Access Control Vulnerability

Missing Authorization vulnerability in cscode WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily innovs-woo-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Manager – Customize and Control...

CVE-2025-50010 WordPress Zapier for WordPress plugin <= 1.5.2 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Zapier Zapier for WordPress zapier allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zapier for WordPress: from n/a through = 1.5.2...

CVE-2025-50034 WordPress Enhanced Blocks – Page Builder Blocks for Gutenberg plugin <= 1.4.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Mahmudul Hasan Arif Enhanced Blocks – Page Builder Blocks for Gutenberg enhanced-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Enhanced Blocks – Page Builder Blocks for Gutenberg: from n/a through = 1.4.1...

CVE-2025-50034 WordPress Enhanced Blocks – Page Builder Blocks for Gutenberg plugin <= 1.4.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Mahmudul Hasan Arif Enhanced Blocks Page Builder Blocks for Gutenberg enhanced-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Enhanced Blocks Page Builder Blocks for Gutenberg: from n/a through = 1.4.1...

CVE-2025-52802 WordPress Import YouTube videos as WP Posts plugin <= 2.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in enguerranws Import YouTube videos as WP Posts import-youtube-videos-as-wp-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Import YouTube videos as WP Posts: from n/a through = 2.1...

WordPress Zara 4 Image Compression plugin <= 1.2.17.2 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Mika in WordPress Plugin Zara 4 Image Compression versions = 1.2.17.2...

WordPress Hello FSE Blog theme <= 1.0.6 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Peter Thaleikis in WordPress Theme Hello FSE Blog versions = 1.0.6...

WordPress eDS Responsive Menu plugin <= 1.2 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Mika in WordPress Plugin eDS Responsive Menu versions = 1.2...

WordPress TM Replace Howdy plugin <= 1.4.2 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Chu The Anh Blue Rock in WordPress Plugin TM Replace Howdy versions = 1.4.2...

WordPress Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes plugin <= 1.0.10 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by ch4r0n in WordPress Plugin Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes versions = 1.0.10...

WordPress UpStream: a Project Management Plugin for WordPress plugin <= 2.1.1 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by domiee13 in WordPress Plugin UpStream: a Project Management Plugin for WordPress versions = 2.1.1...