WordPress Blog2Social plugin <= 8.6.0 - Incorrect Authorization to Video File Upload vulnerability

Incorrect Authorization to Video File Upload vulnerability discovered by thinnawarth mathuros in WordPress Plugin Blog2Social versions = 8.6.0...

WordPress Easy Digital Download plugin <= 3.5.2 - Insufficient Verification to Order Manipulation vulnerability

Insufficient Verification to Order Manipulation vulnerability discovered by Jay - Student in WordPress Plugin Easy Digital Downloads versions = 3.5.2...

WordPress Easy Email Subscription plugin <= 1.3 - Cross-Site Request Forgery to Arbitrary Subscriber Deletion vulnerability

Cross-Site Request Forgery to Arbitrary Subscriber Deletion vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Easy Email Subscription versions = 1.3...

WordPress FunnelKit Automations plugin <= 3.6.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Email Sending vulnerability discovered by Rafshanzani Suhada in WordPress Plugin FunnelKit Automations versions = 3.6.4.1...

WordPress KiotViet Sync plugin <= 1.8.5 - Use of Hard-coded Password to Authorization Bypass vulnerability

Use of Hard-coded Password to Authorization Bypass vulnerability discovered by kr0d in WordPress Plugin KiotViet Sync versions = 1.8.5...

WordPress Depicter Slider plugin <= 4.0.4 - Missing Authorization to Authenticated (Contributor+) Safe File Type Upload vulnerability

Missing Authorization to Authenticated Contributor+ Safe File Type Upload vulnerability discovered by Rafshanzani Suhada in WordPress Plugin Depicter Slider versions = 4.0.4...

WordPress B Carousel Block plugin <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Server-Side Request Forgery vulnerability

Missing Authorization to Authenticated Subscriber+ Server-Side Request Forgery vulnerability discovered by Sushi Com Abacate in WordPress Plugin B Carousel Block versions = 1.1.5...

WordPress Document Embedder plugin <= 2.0.0 - Missing Authorization to Unauthenticated Document Manipulation vulnerability

Missing Authorization to Unauthenticated Document Manipulation vulnerability discovered by ohmymex in WordPress Plugin Document Embedder versions = 2.0.0...

WordPress Paid Membership Subscriptions plugin <= 2.16.4 - Missing Authorization to Unauthenticated Arbitrary Member Subscription Auto Renewal vulnerability

Missing Authorization to Unauthenticated Arbitrary Member Subscription Auto Renewal vulnerability discovered by Rafshanzani Suhada in WordPress Plugin Paid Member Subscriptions versions = 2.16.4...

Drupal Email TFA module < 2.0.6 - Authenticated Broken Access Control vulnerability

Authenticated Broken Access Control vulnerability discovered by Pierre Rudloff prudloff in WordPress Module Email TFA versions 2.0.6...

Drupal Features Module <= 0.0.2 is vulnerable to Broken Access Control

Software Features Type Module Vulnerable versions = 0.0.2 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2025-12582 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 2b7c0646055d Credits Nabil Irawan - Heroes Cyber Security...

WordPress Master Blocks plugin <= 1.4.1.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary plugin Upload vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary plugin Upload vulnerability discovered by theviper17y in WordPress Plugin Master Blocks versions = 1.4.1.3...

WordPress Image Hover Effects for Elementor plugin <= 1.0.2.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Upload vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Upload vulnerability discovered by theviper17y in WordPress Plugin Image Hover Effects for Elementor versions = 1.0.2.3...

WordPress Image Comparison Addon for Elementor plugin <= 1.0.2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary plugin Upload vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary plugin Upload vulnerability discovered by theviper17y in WordPress Plugin Image Comparison Addon for Elementor versions = 1.0.2.2...

WordPress Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One plugin <= 2.3.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by kr0d in WordPress Plugin Ai Auto Tool Content Writing Assistant Gemini Writer, ChatGPT All in One versions = 2.3.0...

WordPress CE21 Suite plugin 2.2.1 - 2.3.1 - Missing Authorization to Unauthenticated Privilege Escalation via plugin Settings Update vulnerability

WordPress CE21 Suite plugin 2.2.1 - 2.3.1 - Missing Authorization to Unauthenticated Privilege Escalation via plugin Settings Update vulnerability discovered by kr0d in WordPress Plugin CE21 Suite versions 2.2.1-2.3.1...

WordPress Content Locker for Elementor plugin <= 1.0.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary plugin Upload vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary plugin Upload vulnerability discovered by theviper17y in WordPress Plugin Content Locker for Elementor versions = 1.0.3...

WordPress WP-CRM System plugin <= 3.4.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin WP-CRM System versions = 3.4.5...

WordPress All in One Time Clock Lite plugin <= 2.0.3 - Missing Authorization to Page Creation and Information Exposure vulnerability

Missing Authorization to Page Creation and Information Exposure vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin All in One Time Clock Lite versions = 2.0.3...

WordPress Crypto Payment Gateway with Payeer for WooCommerce plugin <= 1.0.3 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Crypto Payment Gateway with Payeer for WooCommerce versions = 1.0.3...