CVE-2024-12113

The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the deleteuserreview and deletereview functions in all versions up to, and including, 1.3.2. This...

CVE-2024-12826

The CVE-2024-12826 flaw affects the GoHero Store Customizer for WooCommerce (WordPress). It stems from a missing capability check in the wooh_action_settings_save_frontend() function in all versions up to and including 3.5, enabling unauthenticated attackers to modify limited plugin settings. Imp...

CVE-2024-13370

CVE-2024-13370 affects Youzify (WordPress plugin) and is due to a missing capability check in save_addon_key_license(), enabling authenticated attackers with Subscriber+ privileges to update arbitrary options to a valid license key. Public details in Wordfence/Red Hat and CVE entries show the vul...

CVE-2024-13368

The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress (Youzify) suffers a missing capability check in the youzify_offer_banner() function. All versions up to and including 1.3.2 are affected, enabling authenticated attackers with Subscriber-level acces...

PT-2025-1595 · WordPress · The Quiz Maker Developer +2

Name of the Vulnerable Software and Affected Versions: The Quiz Maker Business plugin for WordPress versions up to, and including, 8.8.0 The Quiz Maker Developer plugin for WordPress versions up to, and including, 21.8.0 The Quiz Maker Agency plugin for WordPress versions up to, and including,...

PT-2025-2177 · WordPress · Boom Fest

Name of the Vulnerable Software and Affected Versions: Boom Fest plugin for WordPress versions prior to 2.3 Description: The issue is related to a missing capability check on the bf admin action function, allowing authenticated attackers with Subscriber-level access and above to update plugin...

PT-2025-1962 · WordPress · Gohero Store Customizer For Woocommerce

Name of the Vulnerable Software and Affected Versions: GoHero Store Customizer for WooCommerce plugin for WordPress versions up to, and including, 3.5 Description: The issue allows unauthorized modification of data due to a missing capability check on the wooh action settings save frontend...

PT-2025-1752 · WordPress · Youzify – Buddypress Community

Name of the Vulnerable Software and Affected Versions: The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress versions up to, and including, 1.3.2 Description: The issue is related to unauthorized loss of data due to a missing capability check on the...

PT-2025-2137 · WordPress · Youzify

Name of the Vulnerable Software and Affected Versions: Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress versions up to, and including, 1.3.2 Description: The issue is related to unauthorized access due to a missing capability check on the save addon k...

CVE-2024-13698

The Jobify - Job Board WordPress Theme for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'downloadimageviaai' and 'generateimageviaai' functions in all versions up to, and including, 4.2.7. This makes it possible for unauthenticat...

CVE-2024-13698

CVE-2024-13698 affects the Jobify – Job Board WordPress Theme (

CVE-2024-13335

The Spexo Addons for Elementor – Free Elementor Addons, Widgets and Templates plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the tmpcoderthemeinstallfunc function in all versions up to, and including, 1.0.14. This makes it possible for authenticated...

CVE-2024-13335 Sastra Essential Addons for Elementor – Free Elementor Addons, Widgets and Templates <= 1.0.14 - Missing Authorization to Spexo Theme Install

The Spexo Addons for Elementor – Free Elementor Addons, Widgets and Templates plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the tmpcoderthemeinstallfunc function in all versions up to, and including, 1.0.14. This makes it possible for authenticated...

CVE-2024-13447

The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hotelbookingloadorderuser AJAX action in all versions up to, and including, 2.1.6. This makes it possible for authenticated attackers, with Subscriber-level access and...

CVE-2024-13447 WP Hotel Booking <= 2.1.6 - Missing Authorization to Authenticated (Subscriber+) User Email Retrieval

The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hotelbookingloadorderuser AJAX action in all versions up to, and including, 2.1.6. This makes it possible for authenticated attackers, with Subscriber-level access and...

CVE-2024-13447

CVE-2024-13447 (WP Hotel Booking plugin for WordPress) suffers from a missing capability check on the hotel_booking_load_order_user AJAX action in all versions up to 2.1.6, enabling authenticated users with Subscriber-level access and above to retrieve a list of registered user emails. The vulner...

CVE-2024-12879

The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'qcwplatestupdatecheckpro' function in all versions up to, and including, 13.5.5. This makes it possible for authenticated attackers, with...

CVE-2024-12879

The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'qcwplatestupdatecheckpro' function in all versions up to, and including, 13.5.5. This makes it possible for authenticated attackers, with...

PT-2025-1975 · WordPress · Wpbot Pro

Name of the Vulnerable Software and Affected Versions: WPBot Pro Wordpress Chatbot plugin for WordPress versions up to, and including, 13.5.5 Description: The issue allows authenticated attackers with Subscriber-level access and above to create Simple Text Responses to chat queries due to a missi...

CVE-2024-12104

The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wpfdeletefile and wpfdeletefile functions in all versions up to, and including, 4.0.9. This makes it possible for...