WordPress Page & Post Notes plugin <= 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Note Update/Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Note Update/Deletion vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin Page & Post Notes versions = 1.3.4...

WordPress IDonate plugin 2.0.0 - 2.1.9 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Deletion via admin_post_donor_delete Function vulnerability

WordPress IDonate plugin 2.0.0 - 2.1.9 - Insecure Direct Object Reference to Authenticated Subscriber+ Arbitrary User Deletion via adminpostdonordelete Function vulnerability discovered by kr0d in WordPress Plugin IDonate versions 2.0.0-2.1.9...

WordPress Ace User Management plugin <= 2.0.3 - Subscriber+ Authentication Bypass via Password Rest vulnerability

Subscriber+ Authentication Bypass via Password Rest vulnerability discovered by aschoiloa1890 in WordPress Plugin Ace User Management versions = 2.0.3...

WordPress Elementinvader Addons for Elementor plugin < 1.4.1 – Unauthenticated Arbitrary Email Sending vulnerability

Unauthenticated Arbitrary Email Sending vulnerability discovered by Lucas Montes in WordPress Plugin ElementInvader Addons for Elementor versions 1.4.1...

PT-2025-45466

Name of the Vulnerable Software and Affected Versions Onlook web application version 0.2.32 Description A Broken Object Level Authorization BOLA issue exists in the tRPC project mutation APIs update, delete, add/remove tag of the Onlook web application. The API does not properly validate if the...

CVE-2025-63783

A Broken Object Level Authorization BOLA vulnerability was discovered in the tRPC project mutation APIs update, delete, add/remove tag of the Onlook web application 0.2.32. The vulnerability exists because the API fails to verify the ownership or membership of the currently authenticated user for...

CVE-2025-62914 WordPress Effect Maker plugin <= 1.2.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in anibalwainstein Effect Maker effect-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Effect Maker: from n/a through = 1.2.1...

CVE-2025-62914 WordPress Effect Maker plugin <= 1.2.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in anibalwainstein Effect Maker effect-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Effect Maker: from n/a through = 1.2.1...

CVE-2025-62914

CVE-2025-62914 concerns the WordPress plugin Effect Maker (

CVE-2025-62064 WordPress Search & Go theme <= 2.7 - Broken Authentication vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in Elated-Themes Search & Go search-and-go allows Password Recovery Exploitation.This issue affects Search & Go: from n/a through = 2.7...

CVE-2025-62049

CVE-2025-62049 is a Missing Authorization (Broken Access Control) vulnerability in WordPress Cost Calculator Builder plugin versions up to and including 3.5.32. Exploitation would allow unauthorized access to the Cost Calculator Builder functionality. The issue is reflected across multiple source...

CVE-2025-62049 WordPress Cost Calculator Builder plugin <= 3.5.32 - Broken Access Control vulnerability

Missing Authorization vulnerability in Stylemix Cost Calculator Builder cost-calculator-builder.This issue affects Cost Calculator Builder: from n/a through = 3.5.32...

CVE-2025-62049 WordPress Cost Calculator Builder plugin <= 3.5.32 - Broken Access Control vulnerability

Missing Authorization vulnerability in Stylemix Cost Calculator Builder cost-calculator-builder.This issue affects Cost Calculator Builder: from n/a through = 3.5.32...

CVE-2025-62037

CVE-2025-62037 concerns the Togo WordPress theme (versions before 1.0.4) with a Missing Authorization/Broken Access Control vulnerability. The issue stems from lack of proper authorization checks, potentially allowing unauthorized access to restricted resources. Public documents from Red Hat, ENI...

CVE-2025-62037 WordPress Togo theme < 1.0.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in uxper Togo togo.This issue affects Togo: from n/a through 1.0.4...

CVE-2025-62037 WordPress Togo theme < 1.0.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in uxper Togo togo.This issue affects Togo: from n/a through 1.0.4...

CVE-2025-62033 WordPress Togo theme < 1.0.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in uxper Togo togo.This issue affects Togo: from n/a through 1.0.4...

CVE-2025-62033

CVE-2025-62033 describes a Missing Authorization vulnerability in uxper Togo/Togo WordPress theme prior to version 1.0.4. Affected software: Togo – Travel & Tour Booking WordPress Theme (and related WordPress Togo theme entries in multiple vendors). Root cause: broken access control allowing unau...

CVE-2025-62033 WordPress Togo theme < 1.0.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in uxper Togo togo.This issue affects Togo: from n/a through 1.0.4...

CVE-2025-62028

CVE-2025-62028 affects the WordPress Salient theme prior to 17.4.0, describing a Missing Authorization/Broken Access Control vulnerability that could allow unauthorized access. The issue is mitigated by upgrading to Salient 17.4.0 or later; no exploit details are provided in the sources.