CVE-2020-36834 Discount Rules for WooCommerce <= 2.0.2 - Missing Authorization

The Discount Rules for WooCommerce plugin for WordPress is vulnerable to missing authorization via several AJAX actions in versions up to, and including, 2.0.2 due to missing capability checks on various functions. This makes it possible for subscriber-level attackers to execute various actions a...

CVE-2020-36834

The CVE-2020-36834 entry concerns the Discount Rules for WooCommerce plugin for WordPress. Affected: plugin versions up to and including 2.0.2. Description and connected sources confirm missing authorization due to insufficient capability checks on several AJAX actions, enabling subscriber‑level ...

CVE-2020-36838 Facebook Chat Plugin <= 1.5 - Missing Capabilities Check

The Facebook Chat Plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wpajaxupdateoptions function in versions up to, and including, 1.5. This flaw makes it possible for low-level authenticated attackers to connect their own Facebook Messenger accou...

CVE-2020-36838

The CVE-2020-36838 entry concerns the Facebook Chat Plugin for WordPress (versions up to and including 1.5). The root cause is an authorization bypass caused by a missing capability check in the wp_ajax_update_options function, enabling low‑level authenticated attackers to connect their own Faceb...

CVE-2020-36838 Facebook Chat Plugin <= 1.5 - Missing Capabilities Check

The Facebook Chat Plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wpajaxupdateoptions function in versions up to, and including, 1.5. This flaw makes it possible for low-level authenticated attackers to connect their own Facebook Messenger accou...

CVE-2023-7288

The Paytium: Mollie payment forms & donations WordPress plugin is affected up to version 4.3.7 due to a missing capability check in update_profile_preference. This allows authenticated users with subscriber-level access to modify plugin settings, potentially impacting data integrity. Remediation:...

CVE-2021-4446

CVE-2021-4446 affects the WordPress plugin Essential Addons for Elementor (versions up to and including 4.6.4). The vulnerability is an authorization bypass caused by missing capability checks and nonce disclosure, enabling authenticated attackers with minimal privileges (e.g., a subscriber) to p...

CVE-2021-4446 Essential Addons for Elementor <= 4.6.4 - Missing Authorization

The Essential Addons for Elementor plugin for WordPress is vulnerable to authorization bypass in versions up to and including 4.6.4 due to missing capability checks and nonce disclosure. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to perform...

CVE-2021-4446 Essential Addons for Elementor <= 4.6.4 - Missing Authorization

The Essential Addons for Elementor plugin for WordPress is vulnerable to authorization bypass in versions up to and including 4.6.4 due to missing capability checks and nonce disclosure. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to perform...

CVE-2023-7287

The CVE-2023-7287 entry concerns the WordPress Paytium: Mollie payment forms & donations plugin (versions up to and including 4.3.7). The root cause is a missing capability check in the pt_cancel_subscription function, allowing authenticated users with subscriber-level access to cancel subscripti...

CVE-2024-9891

The Multiline files upload for contact form 7 plugin for WordPress is vulnerable to unauthorized plugin deactivation due to a missing capability check on the mfcf7zlcustomhandledeactivationpluginformsubmission function in all versions up to, and including, 2.8.1. This makes it possible for...

CVE-2024-9891

CVE-2024-9891 (Multiline files upload for contact form 7, WordPress) is a privilege escalation vulnerability caused by a missing capability check in mfcf7_zl_custom_handle_deactivation_plugin_form_submission(), allowing authenticated Subscriber+ users to deactivate the plugin. Connected sources c...

CVE-2024-9891 Multiline files upload for contact form 7 <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation

The Multiline files upload for contact form 7 plugin for WordPress is vulnerable to unauthorized plugin deactivation due to a missing capability check on the mfcf7zlcustomhandledeactivationpluginformsubmission function in all versions up to, and including, 2.8.1. This makes it possible for...

VulnCheck KEV: CVE-2023-7289

The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized API key update due to a missing capability check on the paytiumswsaveapikeys function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with...

PT-2024-10852 · WordPress · Wpvivid

Name of the Vulnerable Software and Affected Versions: Migration, Backup, Staging – WPvivid plugin for WordPress versions up to, and including 0.9.35 Description: The issue is related to arbitrary file uploads due to a missing capability check on the wpvivid upload import files and wpvivid upload...

WordPress plugin Indeed Membership Pro 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-10850 · Motopress · The Timetable/Event Schedule By Motopress

Name of the Vulnerable Software and Affected Versions: The Timetable and Event Schedule by MotoPress plugin for WordPress versions up to, and including, 2.3.8 Description: The issue is related to a missing capability check on the wp ajax route url function called via a nopriv AJAX action. This...

VulnCheck KEV: CVE-2023-7288

The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the updateprofilepreference function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with...

PT-2024-15274 · WordPress · The Paytium: Mollie Payment Forms & Donations

Name of the Vulnerable Software and Affected Versions: The Paytium: Mollie payment forms & donations plugin for WordPress versions up to, and including, 4.3.7 Description: The issue allows unauthorized access to data due to a missing capability check on the check mollie account details function...

VulnCheck KEV: CVE-2020-36835

The Migration, Backup, Staging - WPvivid plugin for WordPress is vulnerable to sensitive information disclosure of a WordPress site's database due to missing capability checks on the wpajaxwpvividaddremote AJAX action that allows low-level authenticated attackers to send back-ups to a...