CVE-2024-11926

The Travel Booking WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'stPartnerCreateServiceRental', 'stdeleteorderitem', 'stpartnerapprovebooking', 'saveorderitem', and 'userDenyEachInfo' functions in all versions up t...

CVE-2024-11926

CVE-2024-11926 (Travel Booking WordPress Theme) in Travel Booking WordPress Theme (Trav eler) is a capability check bypass vulnerability. The issue arises from missing capability checks on functions: __stPartnerCreateServiceRental, st_delete_order_item, _st_partner_approve_booking, save_order_ite...

CVE-2024-12596

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to arbitrary post deletion due to a missing capability check on the 'llmsdeletecert' action in all versions up to, and including, 7.8.5. This makes it possible for authenticated attackers, with...

PT-2024-17349 · WordPress · The Travel Booking Wordpress Theme

Name of the Vulnerable Software and Affected Versions: Travel Booking WordPress Theme versions up to, and including, 3.1.6 Description: The issue allows authenticated attackers with Subscriber-level access and above to modify data without permission due to a missing capability check on several...

PT-2024-17670 · WordPress · Lifterlms

Name of the Vulnerable Software and Affected Versions: LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress versions up to, and including, 7.8.5 Description: The issue is related to a missing capability check on the 'llms delete cert' action, which allows authenticated...

CVE-2024-11715

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the assignUserRole function in all versions up to, and including, 2.2.2. This makes it possible for unauthenticated...

CVE-2024-11712 WP Job Portal <= 2.2.2 - Missing Authorization to Unauthenticated Arbitrary Resume Download

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getResumeFileDownloadById function in all versions up to, and including, 2.2.2. This makes it possible for...

CVE-2024-11712

CVE-2024-11712 (WP Job Portal for WordPress) Vulnerability in WP Job Portal up to version 2.2.2 allows unauthenticated access to resumes due to a missing authorization check in getResumeFileDownloadById(). Affected product: WP Job Portal – A Complete Recruitment System for WordPress. Impact: unau...

PT-2024-17202 · WordPress · Wp Job Portal

Name of the Vulnerable Software and Affected Versions: WP Job Portal – A Complete Recruitment System plugin for WordPress versions up to, and including, 2.2.2 Description: The WP Job Portal plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the...

CVE-2024-11911

The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the installwoocommerceplugin function action in all versions up to, and including, 2.1.12. This makes it possible for authenticated attackers, with Subscriber-level acce...

CVE-2024-11911 WP Crowdfunding <= 2.1.12 - Missing Authorization to Authenticated (Subscriber+) WooCommerce Installation

The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the installwoocommerceplugin function action in all versions up to, and including, 2.1.12. This makes it possible for authenticated attackers, with Subscriber-level acce...

CVE-2024-12300 AR for WordPress <= 7.3 - Missing Authorization to Unauthenticated Limited File Upload

The AR for WordPress plugin for WordPress is vulnerable to unauthorized double extension file upload due to a missing capability check on the setarfeaturedimage function in all versions up to, and including, 7.3. This makes it possible for unauthenticated attackers to upload php files leveraging ...

CBL Mariner 2.0 Security Update: mariadb (CVE-2024-5814)

The version of mariadb installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-5814 advisory. - A malicious TLS1.2 server can force a TLS1.3 client with downgrade capability to use a ciphersuite that it d...

PT-2024-17342 · Unknown +1 · Woocommerce +1

Name of the Vulnerable Software and Affected Versions: WP Crowdfunding plugin for WordPress versions up to, and including, 2.1.12 Description: The issue is related to a missing capability check on the install woocommerce plugin function action, allowing authenticated attackers with Subscriber-lev...

PT-2024-17534 · WordPress · Ar

Name of the Vulnerable Software and Affected Versions: AR for WordPress plugin for WordPress versions up to, and including, 7.3 Description: The issue is related to unauthorized double extension file upload due to a missing capability check on the set ar featured image function. This allows...

CVE-2024-12201

The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check when creating form styles in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Contributor-level access and above, ...

CVE-2024-12201

The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check when creating form styles in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Contributor-level access and above, ...

CVE-2024-12329 Essential Real Estate <= 5.1.6 - Missing Authorization to Authenticated (Contributor+) Information Exposure

The Essential Real Estate plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on several pages/post types in all versions up to, and including, 5.1.6. This makes it possible for authenticated attackers, with Contributor-level access and above, to...

CVE-2024-11724 Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) <= 3.6.5 - Missing Authorization to Authenticated (Subscriber+) Whitelist Script

The Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker for GDPR, CCPA & ePrivacy plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wplscriptsave AJAX action in all versions up to, and including, 3.6.5...

CVE-2024-11724

CVE-2024-11724 concerns the WordPress plugin Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (GDPR/CCPA/ePrivacy). The issue is described as a missing capability check on the wpl_script_save AJAX action in all versions up to and including 3.6.5, enabling authen...