CVE-2025-53997 WordPress Houzez theme <= 4.0.4 - Broken Access Control Vulnerability

Missing Authorization vulnerability in favethemes Houzez houzez allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Houzez: from n/a through = 4.0.4...

CVE-2025-53997

Summary: CVE-2025-53997 is a Missing Authorization (Broken Access Control) vulnerability affecting the Houzez WordPress theme, with affected versions up to 4.0.4. The issue arises from incorrectly configured access control security levels. The CVE entry has a medium severity (CVSS v3.1: 4.3) and ...

CVE-2025-53986

CVE-2025-53986 is a Missing Authorization vulnerability in ThemeIsle Hestia (WordPress theme) affecting versions up to 3.2.10. The issue allows access to functionality not properly constrained by ACLs (Broken Access Control). CVSS v3.1 base score: 5.3 (Medium). remediation: update to 3.2.11 or la...

WordPress Hestia Theme <= 3.2.10 is vulnerable to Broken Access Control

Software Hestia Type Theme Vulnerable versions = 3.2.10 Fixed in 3.2.11 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2025-53986 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 41f2dbfe1ff2 Credits Martino Spagnuolo r3verii Required...

WordPress Houzez Theme <= 4.0.4 is vulnerable to Broken Access Control

Software Houzez Type Theme Vulnerable versions = 4.0.4 Fixed in 4.1.1 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2025-53997 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d8d88cb889a1 Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber...

Drupal File Download module < 1.9.0,2.0.0 - Unauthenticated Broken Access Control vulnerability

Unauthenticated Broken Access Control vulnerability discovered by Willem Drupal enthousiast willempje2 in WordPress Module File Download versions 1.9.0,2.0.0...

WordPress URL Shortener <= 3.0.7 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by ch4r0n in WordPress Plugin URL Shortener versions = 3.0.7...

CVE-2025-6838

The Broken Link Notifier plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.3.0 via broken links that are later exported. This makes it possible for authenticated attackers, with Contributor-level access and above, to embed untrusted input into exported CS...

CVE-2025-6851

The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via the ajaxblinks function which ultimately calls the checkurlstatuscode function. This makes it possible for unauthenticated attackers to make web requests to...

CVE-2025-6851

The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via the ajaxblinks function which ultimately calls the checkurlstatuscode function. This makes it possible for unauthenticated attackers to make web requests to...

CVE-2025-6838

The Broken Link Notifier plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.3.0 via broken links that are later exported. This makes it possible for authenticated attackers, with Contributor-level access and above, to embed untrusted input into exported CS...

WordPress Product XML Feed Manager for WooCommerce <= 2.9.2 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by domiee13 in WordPress Plugin Product XML Feed Manager for WooCommerce versions = 2.9.2...

CVE-2025-6838

CVE-2025-6838 affects WordPress Broken Link Notifier plugin up to and including 1.3.0. The vulnerability arises from CSV injection via broken links exported to CSV, enabling authenticated attackers with Contributor-level access or higher to embed untrusted input that can lead to code execution on...

CVE-2025-6838 Broken Link Notifier <= 1.3.0 - Authenticated (Contributor+) CSV Injection

The Broken Link Notifier plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.3.0 via broken links that are later exported. This makes it possible for authenticated attackers, with Contributor-level access and above, to embed untrusted input into exported CS...

CVE-2025-6851 Broken Link Notifier <= 1.3.0 - Unauthenticated Server-Side Request Forgery

The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via the ajaxblinks function which ultimately calls the checkurlstatuscode function. This makes it possible for unauthenticated attackers to make web requests to...

CVE-2025-6851

The CVE-2025-6851 entry concerns the WordPress Broken Link Notifier plugin. Affected are versions up to and including 1.3.0, where the ajax_blinks() path ultimately calls check_url_status_code(), allowing unauthenticated SSRF from the web application to reach arbitrary external or internal locati...

CVE-2025-6851 Broken Link Notifier <= 1.3.0 - Unauthenticated Server-Side Request Forgery

The Broken Link Notifier plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.0 via the ajaxblinks function which ultimately calls the checkurlstatuscode function. This makes it possible for unauthenticated attackers to make web requests to...

WordPress The E-Commerce ERP <= 2.1.1.3 - Privilege Escalation Vulnerability

Privilege Escalation Vulnerability discovered by ch4r0n in WordPress Plugin The E-Commerce ERP versions = 2.1.1.3...

WordPress Simple Link Directory plugin < 14.8.1 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Simple Link Directory versions 14.8.1...

PT-2025-29219 · WordPress · Broken Link Notifier

Name of the Vulnerable Software and Affected Versions: Broken Link Notifier plugin for WordPress versions prior to 1.3.1 Description: The plugin is susceptible to Server-Side Request Forgery SSRF. This allows unauthenticated attackers to make web requests to arbitrary locations originating from t...