CVE-2021-4383 WP Quick FrontEnd Editor <= 5.5 - Authenticated (Subscriber+) Content Injection

The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to page content injection in versions up to, and including, 5.5. This is due to missing capability checks in the plugin's page-editing functionality. This makes it possible for low-authenticated attackers, such as subscribers, to...

CVE-2021-4383

CVE-2021-4383 affects the WP Quick FrontEnd Editor plugin for WordPress. Technical details in the connected documents show a vulnerability in page-editing due to missing capability checks, making it possible for low-authenticated users (e.g., subscribers) to edit or create any page or post on sit...

CVE-2019-25151

The CVE-2019-25151 issue affects the Funnel Builder plugin for WordPress, specifically versions up to and including 1.3.0. The root cause is a missing capability check in the activate_plugin function, which enables an authenticated attacker to bypass authorization and activate any plugin on the v...

CVE-2021-4375

The Welcart e-Commerce plugin for WordPress is affected by CVE-2021-4375 due to a missing capability check in the usces_download_system_information() function in versions up to 2.2.7. This enables authenticated attackers to download WordPress settings, plugin settings, PHP settings, and server se...

CVE-2021-4375 Welcart e-Commerce < 2.2.8 - Missing Capabilities Check to Information Disclosure

The Welcart e-Commerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the uscesdownloadsysteminformation function in versions up to, and including, 2.2.7. This makes it possible for authenticated attackers to download information including WordPres...

CVE-2023-3126

The CVE-2023-3126 entry concerns the WordPress plugin B2BKing . A missing capability check in the function b2bkingdownloadpricelist (affected versions: up to and including 4.6.00) allows authenticated users with subscriber/customer-level permissions to retrieve the site’s full product pricing lis...

CVE-2023-3126

The B2BKing plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'b2bkingdownloadpricelist' function in versions up to, and including, 4.6.00. This makes it possible for Authenticated attackers with subscriber or customer-level permissions to...

CVE-2023-3125 B2BKing <= 4.6.00 - Missing Authorization to Authenticated(Subscriber+) Price Modification

The B2BKing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'b2bkingsavepriceimport' function in versions up to, and including, 4.6.00. This makes it possible for Authenticated attackers with subscriber or customer-level permissions...

CVE-2021-4367 Flo Forms – Easy Drag & Drop Form Builder <= 1.0.35 - Options Change to Stored Cross-Site Scripting

The Flo Forms – Easy Drag & Drop Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Options Change by using the floimportformsoptions AJAX action in versions up to, and including, 1.0.35 due to insufficient input sanitization and output escaping along with missing...

CVE-2021-4367

The Flo Forms – Easy Drag & Drop Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Options Change by using the floimportformsoptions AJAX action in versions up to, and including, 1.0.35 due to insufficient input sanitization and output escaping along with missing...

CVE-2020-36719 ListingPro - WordPress Directory & Listing Theme < 2.6.1 - Arbitrary Plugin Installation, Activation and Deactivation

The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Arbitrary Plugin Installation, Activation and Deactivation in versions before 2.6.1. This is due to a missing capability check on the lpccaddonsactions function. This makes it possible for unauthenticated attacker...

CVE-2020-36716

The CVE-2020-36716 entry concerns the WordPress WP Activity Log plugin. Affected component: the setup_page function; root cause is a missing capability check, leading to an authorization bypass. Impact: unauthenticated attackers could run the setup wizard (if not previously completed) and access ...

CVE-2020-36715 Login/Signup Popup < 1.5 - Missing Authorization

The Login/Signup Popup plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on several functions in versions up to, and including, 1.4. This makes it possible for authenticated attackers to inject arbitrary web scripts into the plugin settings that execute i...

CVE-2021-4364

CVE-2021-4364 involves the WordPress plugin JobSearch WP Job Board . The vulnerability is an authorization bypass caused by a missing capability check in the function jobsearch_add_job_import_schedule_call() , affecting versions up to and including 1.8.1. This allows authenticated attackers to ad...

CVE-2021-4364 JobSearch WP Job Board < = 1.8.1 - Missing Authorization on jobsearch_update_job_import_schedule_call() function

The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearchaddjobimportschedulecall function in versions up to, and including, 1.8.1. This makes it possible for authenticated attackers to add and/or modify schedule calls...

CVE-2021-4361

CVE-2021-4361 affects the WordPress plugin JobSearch WP Job Board. The vulnerability is an authorization bypass caused by a missing capability check on the AJAX action jobsearch_job_integrations_settin_save in versions up to and including 1.8.1. This allows authenticated attackers to update arbit...

CVE-2021-4362

The CVE-2021-4362 issue affects the Kiwi Social Share plugin for WordPress (version 2.1.0). The vulnerability is an authorization bypass caused by a missing capability check in the kiwi_social_share_get_option() function invoked via the kiwi_social_share_get_option AJAX action, allowing unauthent...

CVE-2021-4357 uListing <= 1.6.6 - Unauthenticated Arbitrary Post/Page Deletion

The uListing plugin for WordPress is vulnerable to authorization bypass due to missing capability checks, and a missing security nonce, on the UlistingUserRole::saveroleapi function in versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to arbitrarily delete...

CVE-2021-4357

Summary : The WordPress uListing plugin is vulnerable to an authorization bypass in the function UlistingUserRole::save_role_api up to and including version 1.6.6 . The root cause is missing capability checks and a missing security nonce, which could allow unauthenticated attackers to arbitrarily...

CVE-2022-4948 FlyingPress <= 3.9.6 - Missing Authorization

The FlyingPress plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up to, and including, 3.9.6. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to interact with the plugin in...