PT-2023-11841 · WordPress · Quick Page/Post Redirect Plugin

Name of the Vulnerable Software and Affected Versions: The Quick Page/Post Redirect Plugin for WordPress versions up to, and including, 5.1.9 Description: The issue is related to authorization bypass due to missing capability checks on the qppr save quick redirect ajax and qppr delete quick...

WordPress Plugin Quick Page/Post Redirect 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

PT-2023-12444 · WordPress · Ulisting

Name of the Vulnerable Software and Affected Versions: uListing plugin for WordPress versions up to, and including, 1.6.6 Description: The issue allows for authorization bypass via Ajax due to missing capability checks, missing input validation, and a missing security nonce in the stm update emai...

PT-2023-12460 · WordPress · Frontend File Manager

Name of the Vulnerable Software and Affected Versions: Frontend File Manager plugin for WordPress versions up to and including 18.2 Description: The issue arises from lacking authentication protections, capability checks, and sanitization on the wpfm file meta update AJAX action. This allows...

PT-2023-12492 · WordPress · Ulisting

Name of the Vulnerable Software and Affected Versions: uListing plugin for WordPress versions up to, and including, 1.6.6 Description: The issue allows unauthorized access due to missing capability checks and a missing security nonce in the StmListingSingleLayout::import new layout method. This...

PT-2023-12491

Name of the Vulnerable Software and Affected Versions Pinterest Automatic plugin for WordPress versions up to, and including, 1.14.3 Description The Pinterest Automatic plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the wp pinterest automatic parse...

PT-2023-11366 · WordPress · The Coming Soon Page & Maintenance Mode

Name of the Vulnerable Software and Affected Versions: The Coming Soon Page & Maintenance Mode plugin for WordPress versions up to, and including 1.8.1 Description: The issue is related to missing capability checks in the /functions/data-reset-post.php file, allowing unauthenticated attackers to...

PT-2023-12495 · WordPress · Wp Quick Frontend Editor

Name of the Vulnerable Software and Affected Versions: WP Quick FrontEnd Editor plugin for WordPress versions up to and including 5.5 Description: The issue is related to page content injection due to missing capability checks in the plugin's page-editing functionality. This allows...

WordPress Plugin Pinterest Automatic 访问控制错误漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. The WordPress Plugin Pinterest Automatic...

PT-2023-12488 · WordPress · Doneren Met Mollie

Name of the Vulnerable Software and Affected Versions: Doneren met Mollie plugin for WordPress versions up to and including 2.8.5 Description: The issue concerns Sensitive Data Exposure due to missing capability checks in the dmm export donations function, which is called via the admin post dmm...

WordPress Plugin Welcart e-Commerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers running PHP and MySQL.WordPress plugin i...

Online Booking & Scheduling Calendar for WordPress by vcita <= 4.3.3 - Missing Capability Checks

The plugin does not apply capability checks on the vcitasavesettingscallback function, making it possible for attackers with low privileges, like subscribers, to modify the plugin's settings, upload media files, and conduct XSS attacks...

Metform Elementor Contact Form Builder < 3.3.2 - Unauthenticated Permalink Structure Update

The plugin does not properly implement capability checks on the permalinksetup function, leading to unauthorized permalink structure updates...

WooCommerce Multivendor Marketplace – REST API < 1.6.0 - Subscriber+ Arbitrary Orders Item And Notes Update

The plugin does not properly implement capability checks on the 'getitem', 'getordernotes', and 'addordernote' functions, leading to potential unauthorized access and addition of those items by authenticated users with subscriber privileges or above...

OoohBoi Steroids for Elementor < 2.1.5 - Arbitrary File Upload

The plugin does not properly protect its fileuploadercallback function with capability checks, which makes it possible for attackers with a low-privilege account, like subscribers, to upload image attachments to the site...

VulnCheck KEV: CVE-2022-4940

The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.10.0 due to missing capability checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of actions...

CVE-2022-4940

The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.10.0 due to missing capability checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of actions such ...

CVE-2022-4940

The WCFM Membership plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 2.10.0 due to missing capability checks on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of actions such ...

Design/Logic Flaw

The WCFM Frontend Manager plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 6.6.0 due to missing capability checks on various AJAX actions. This makes it possible for authenticated attackers, with minimal permissions such as...

Design/Logic Flaw

The WCFM Marketplace plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 3.4.11 due to missing capability checks on various AJAX actions. This makes it possible for authenticated attackers, with minimal permissions such as...