CVE-2024-10854 Buy one click WooCommerce <= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Settings Import

The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the buyoneclickimportoptions AJAX action in all versions up to, and including, 2.2.9. This makes it possible for authenticated attackers, with Subscriber-leve...

CVE-2024-10717

CVE-2024-10717 - Styler for Ninja Forms (WordPress) Affected: Styler for Ninja Forms plugin for WordPress, all versions up to and including 3.3.4. Root cause: Missing capability check in the deactivate_license function enables unauthorized modification of data by authenticated users with Subscrib...

CVE-2024-10854: Missing Authorization

The Buy one click WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the buyoneclickimportoptions AJAX action in all versions up to, and including, 2.2.9. This makes it possible for authenticated attackers, with Subscriber-leve...

CVE-2024-10531: Missing Authorization

The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the updateassistant function in all versions up to, and including, 2.1.7. This makes it possible for authenticated attackers, with subscriber-level acce...

PT-2024-16487 · WordPress · The Styler For Ninja Forms

Name of the Vulnerable Software and Affected Versions: The Styler for Ninja Forms plugin for WordPress versions up to, and including, 3.3.4 Description: The issue allows unauthorized modification of data, potentially leading to a denial of service, due to a missing capability check on the...

CVE-2021-27701: Cross-Site Request Forgery (CSRF)

SOCIFI Socifi Guest wifi as SAAS is affected by Cross Site Request Forgery CSRF via the Socifi wifi portal. The application does not contain a CSRF token and request validation. An attacker can Add/Modify any random user data by sending a crafted CSRF request...

PT-2024-16593

Name of the Vulnerable Software and Affected Versions Buy one click WooCommerce plugin for WordPress versions up to, and including, 2.2.9 Description The issue is related to a missing capability check on the buy one click import options AJAX action, allowing authenticated attackers with...

PT-2024-16348 · WordPress · Kognetiks Chatbot

Name of the Vulnerable Software and Affected Versions: Kognetiks Chatbot for WordPress plugin for WordPress versions up to, and including, 2.1.7 Description: The issue is related to unauthorized modification of data due to a missing capability check on the update assistant function. This allows...

PT-2024-16704 · Grand Vice Info · Webopac

Name of the Vulnerable Software and Affected Versions: Webopac from Grand Vice info affected versions not specified Description: The issue is a SQL Injection vulnerability, allowing unauthenticated remote attacks to inject arbitrary SQL commands to read, modify, and delete database contents...

CVE-2024-10589

CVE-2024-10589 - Leopard WordPress Offload Media (plugin) Affected: Leopard - WordPress Offload Media plugin for WordPress, versions up to and including 3.1.1. Root cause: missing capability check in import_settings() function, enabling unauthorized modification of data. Impact: authenticated att...

CVE-2024-10535

The Video Gallery for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the removeunusedthumbnails function in all versions up to, and including, 1.31. This makes it possible for unauthenticated attackers to delete thumbnails ...

WordPress plugin Video Gallery for WooCommerce has security vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-10535: Missing Authorization

The Video Gallery for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the removeunusedthumbnails function in all versions up to, and including, 1.31. This makes it possible for unauthenticated attackers to delete thumbnails ...

CVE-2024-7429

The Zotpress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ZotpressprocessaccountsAJAX function in all versions up to, and including, 7.3.12. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2024-7429

CVE-2024-7429 affects the Zotpress WordPress plugin. The vulnerability is due to a missing capability check in Zotpress_process_accounts_AJAX, allowing authenticated attackers with Contributor-level access or higher to modify data and reset the plugin’s settings in all versions up to 7.3.12. The ...

WordPress plugin Zotpress has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

SuiteCRM SQL injection vulnerability

SuiteCRM is an open source, enterprise-level customer relationship management CRM software. SuiteCRM suffers from a SQL injection vulnerability that is caused by insufficient validation of input values. An attacker can exploit the vulnerability to execute SQL commands, which in turn may be used t...

CVE-2024-7424

The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to unauthorized modification of and access to data due to a missing capability check on several functions in all versions up to, and including, 4.0.1. This makes it possible for authenticated attackers, with...

CVE-2024-7424 Multiple Page Generator Plugin – MPG <= 4.0.1 - Missing Authorization

The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to unauthorized modification of and access to data due to a missing capability check on several functions in all versions up to, and including, 4.0.1. This makes it possible for authenticated attackers, with...

WordPress plugin: Multiple Page Generator Plugin – MPG access control error vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An access control error...