CVE-2025-39602

CVE-2025-39602 is a Missing Authorization vulnerability in the WordPress plugin WooCommerce Product Table Lite (versions up to and including 3.9.5). Multiple sources (NVD, patch provider) confirm the issue, with a CVSS v3.1 base score of 4.3 (Medium) and an impact profile of no confidentiality/av...

CVE-2025-39602 WordPress WooCommerce Product Table Lite plugin <= 3.9.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in WC Product Table WooCommerce Product Table Lite allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WooCommerce Product Table Lite: from n/a through 3.9.5...

CVE-2025-30960 WordPress FS Poster plugin <= 6.5.8 - Subscriber+ Site Wide Broken Access Control vulnerability

Missing Authorization vulnerability in fs-code FS Poster fs-poster.This issue affects FS Poster: from n/a through = 6.5.8...

CVE-2025-30960 WordPress FS Poster plugin <= 6.5.8 - Subscriber+ Site Wide Broken Access Control vulnerability

Missing Authorization vulnerability in fs-code FS Poster fs-poster.This issue affects FS Poster: from n/a through = 6.5.8...

CVE-2025-30960

CVE-2025-30960 is a Missing Authorization vulnerability in the FS Poster WordPress plugin (NotFound FS Poster), affecting versions n/a through 6.5.8. Connected sources (Patchstack/Red Hat/NVD) describe a Subscriber+ site-wide broken access control; no exploitation status is provided. Remediation:...

CVE-2025-26953

CVE-2025-26953 is a Missing Authorization vulnerability in Crocoblock JetMenu (JetMenu for Elementor) affecting versions up to and including 2.4.9. The issue allows accessing functionality not constrained by ACLs, with CVSS v3.1 base score 7.5 (Network, Low attack complexity, No privileges requir...

CVE-2025-27008 WordPress Unlimited Timeline < 1.6.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in NotFound Unlimited Timeline unlimited-timeline allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Unlimited Timeline: from n/a through 1.6.1...

CVE-2025-27008 WordPress Unlimited Timeline < 1.6.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in NotFound Unlimited Timeline unlimited-timeline allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Unlimited Timeline: from n/a through 1.6.1...

CVE-2025-26953 WordPress JetMenu plugin <= 2.4.9 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Crocoblock JetMenu jet-menu allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JetMenu: from n/a through = 2.4.9...

CVE-2025-26953 WordPress JetMenu plugin <= 2.4.9 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Crocoblock JetMenu jet-menu allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JetMenu: from n/a through = 2.4.9...

CVE-2025-27008

CVE-2025-27008 is a Missing Authorization vulnerability in the WordPress plugin Unlimited Timeline (unlimited-timeline) affecting versions prior to 1.6.1. The issue allows access to functionality not properly constrained by ACLs. Public sources (Patchstack) indicate a fix in Unlimited Timeline 1....

WordPress FS Poster plugin <= 6.5.8 - Subscriber+ Site Wide Broken Access Control vulnerability

Subscriber+ Site Wide Broken Access Control vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin FS Poster versions = 6.5.8...

CVE-2025-24358 gorilla/csrf CSRF vulnerability due to broken Referer validation

gorilla/csrf provides Cross Site Request Forgery CSRF prevention middleware for Go web applications & services. Prior to 1.7.2, gorilla/csrf does not validate the Origin header against an allowlist. Its executes its validation of the Referer header for cross-origin requests only when it believes...

CVE-2025-26958 WordPress JetBlog plugin <= 2.4.3 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Crocoblock JetBlog jet-blog allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JetBlog: from n/a through = 2.4.3...

CVE-2025-26944 WordPress JetPopup plugin <= 2.0.11 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Crocoblock JetPopup jet-popup allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JetPopup: from n/a through = 2.0.11...

CVE-2025-26958 WordPress JetBlog plugin <= 2.4.3 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Crocoblock JetBlog jet-blog allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JetBlog: from n/a through = 2.4.3...

CVE-2025-26955 WordPress Industrial Lite theme <= 1.0.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in vowelweb Industrial Lite industrial-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Industrial Lite: from n/a through = 1.0.8...

CVE-2025-26944 WordPress JetPopup plugin <= 2.0.11 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Crocoblock JetPopup jet-popup allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JetPopup: from n/a through = 2.0.11...

CVE-2025-26942 WordPress JetTricks plugin <= 1.5.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Crocoblock JetTricks jet-tricks allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JetTricks: from n/a through = 1.5.1...

CVE-2025-26942 WordPress JetTricks plugin <= 1.5.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Crocoblock JetTricks jet-tricks allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JetTricks: from n/a through = 1.5.1...