CVE-2025-53304

CVE-2025-53304 concerns the WordPress plugin “Contact Form – 7: Hide Success Message.” It affects versions up to 1.1.4 and is described as a Missing Authorization vulnerability that allows accessing functionality not properly constrained by ACLs. The CVE entry indicates a base score of 5.3 (Mediu...

CVE-2025-53295 WordPress iCount Payment Gateway plugin <= 2.0.6 - Broken Access Control Vulnerability

Missing Authorization vulnerability in iCount iCount Payment Gateway allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects iCount Payment Gateway: from n/a through 2.0.6...

CVE-2025-53293

CVE-2025-53293 affects the WordPress Dashboard Widget Sidebar plugin (versions up to 1.2.3). The issue is a Missing Authorization vulnerability caused by misconfigured access control, allowing unauthorized access to protected resources. Public details in the provided documents identify the compon...

CVE-2025-53288

CVE-2025-53288 corresponds to a Missing Authorization vulnerability in the WordPress plugin “PlatiOnline Payments” (versions up to 6.3.2). The issue arises from misconfigured access control, enabling unauthorized access due to insufficient authorization checks. Public details in Patchstack/Red Ha...

CVE-2025-53288 WordPress PlatiOnline Payments plugin <= 7.0.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Adrian Ladó PlatiOnline Payments plationline allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PlatiOnline Payments: from n/a through = 7.0.0...

CVE-2025-53284 WordPress CMS Blocks plugin <= 1.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in pankaj.sakaria CMS Blocks cms-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CMS Blocks: from n/a through = 1.1...

CVE-2025-53284

CVE-2025-53284 : Missing Authorization vulnerability in the WordPress plugin CMS Blocks (versions n/a–1.1) due to incorrectly configured access control. This may allow an attacker with low privileges to access restricted resources over the network, with high impact on confidentiality but no state...

CVE-2025-53266 WordPress Cron Logger plugin <= 1.3.0 - Broken Access Control Vulnerability

Missing Authorization vulnerability in EdwardBock Cron Logger cron-logger allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cron Logger: from n/a through = 1.3.0...

CVE-2025-53255 WordPress HurryTimer plugin <= 2.13.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Nabil Lemsieh HurryTimer hurrytimer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HurryTimer: from n/a through = 2.13.1...

CVE-2025-53255 WordPress HurryTimer plugin <= 2.13.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Nabil Lemsieh HurryTimer allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects HurryTimer: from n/a through 2.13.1...

CVE-2025-52817

The CVE refers to the WordPress plugin Abandoned Contact Form 7 (versions n/a through 2.0) with a Missing Authorization / Broken Access Control vulnerability. Affected component is the plugin’s access control configuration, enabling exploitation due to incorrectly configured access levels. CVSS/m...

CVE-2025-52817 WordPress Abandoned Contact Form 7 plugin <= 2.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in ZealousWeb Abandoned Contact Form 7 abandoned-contact-form-7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Abandoned Contact Form 7: from n/a through = 2.2...

CVE-2025-52818 WordPress Trusty Whistleblowing plugin <= 1.5.2 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Dejan Jasnic Trusty Whistleblowing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Trusty Whistleblowing: from n/a through 1.5.2...

WordPress BuddyPress Docs plugin < 2.2.5 - Subscriber+ Arbitrary Document Read/Update vulnerability

Subscriber+ Arbitrary Document Read/Update vulnerability discovered by Terrence Bosco, Alexus Bosco, Andrew Risorto in WordPress Plugin BuddyPress Docs versions 2.2.5...

WordPress Sertifier Certificate & Badge Maker plugin <= 1.21 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by domiee13 in WordPress Plugin Sertifier Certificate & Badge Maker versions = 1.21...

WordPress Constructor Theme <= 1.6.5 is vulnerable to Broken Access Control

Software Constructor Type Theme Vulnerable versions = 1.6.5 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2025-53302 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 616342014c3c Credits Sulabh Jain Required privilege...

WordPress VG WORT METIS plugin <= 2.0.0 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update vulnerability

Missing Authorization to Authenticated Subscriber+ Limited Settings Update vulnerability discovered by ch4r0n in WordPress Plugin VG WORT METIS versions = 2.0.0...

WordPress VG WORT METIS plugin <= 2.0.1 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Nguyen Ngoc Quang Bach maysbachs in WordPress Plugin VG WORT METIS versions = 2.0.1...

WordPress Amazon Products to WooCommerce plugin <= 1.2.7 - Missing Authorization to Unauthenticated Arbitrary Product Creation vulnerability

Missing Authorization to Unauthenticated Arbitrary Product Creation vulnerability discovered by ch4r0n in WordPress Plugin Amazon Products to WooCommerce versions = 1.2.7...

WordPress Coupon Affiliates plugin <= 7.2.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ryan Novotny in WordPress Plugin Coupon Affiliates versions = 7.2.0...