PT-2023-32080

Name of the Vulnerable Software and Affected Versions Funnelforms Free plugin for WordPress versions up to, and including, 3.4 Description The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the fnsf delete posts function. This allows unauthenticated...

CVE-2023-5651: Incorrect Permission Assignment for Critical Resource

The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not ensure that the package to be deleted is a package, allowing any authenticated users, such as subscriber to delete arbitrary posts...

CVE-2023-5506

The ImageMapper plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'imgmapdeleteareaajax' function in versions up to, and including, 1.2.6. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to...

CVE-2023-2173: Authorization Bypass Through User-Controlled Key

The BadgeOS plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.7.1.6. This is due to improper validation and authorization checks within the badgeosdeletestepajaxhandler, badgeosdeleteawardstepajaxhandler, badgeosdeletedeductstepajaxhandler,...

CVE-2023-1889: Authorization Bypass Through User-Controlled Key

The Directorist plugin for WordPress is vulnerable to an Insecure Direct Object Reference in versions up to, and including, 7.5.4. This is due to improper validation and authorization checks within the listingtask function. This makes it possible for authenticated attackers, with subscriber-level...

PT-2022-9452

Name of the Vulnerable Software and Affected Versions Orange Form WordPress plugin version 1.0 Description The issue concerns an unprepared SQL query with an unsanitized parameter $id in the process bulk action function, located in the "admin/orange-form-email.php" file. Although only admins can...

CVE-2021-24688: Improper Access Control

The Orange Form WordPress plugin through 1.0.1 does not have any authorisation and CSRF checks in all of its AJAX calls, for example the ordeletefiled one which is available to both unauthenticated and authenticated users could allow attackers to delete arbitrary posts.The AJAX calls performing...

PT-2022-9628

Name of the Vulnerable Software and Affected Versions The NextScripts: Social Networks Auto-Poster WordPress plugin versions prior to 4.3.25 Description The issue allows an attacker to make a logged-in admin delete arbitrary posts via a CSRF attack because there is no CSRF check in place when...

CVE-2021-25013

The Qubely WordPress plugin before 1.7.8 does not have authorisation and CSRF check on the qubelydeletesavedblock AJAX action, and does not ensure that the block to be deleted belong to the plugin, as a result, any authenticated users, such as subscriber can delete arbitrary posts...

CVE-2021-24783

The Post Expirator WordPress plugin before 2.6.0 does not have proper capability checks in place, which could allow users with a role as low as Contributor to schedule deletion of arbitrary posts...

PT-2021-16278

Name of the Vulnerable Software and Affected Versions: Post Expirator WordPress plugin versions prior to 2.6.0 Description: The issue concerns improper capability checks, which could allow users with a role as low as Contributor to schedule deletion of arbitrary posts. Recommendations: For versio...

PT-2015-5897

Name of the Vulnerable Software and Affected Versions WPML plugin versions prior to 3.1.9 Description The issue concerns the "menu sync" function, which allows remote attackers to delete arbitrary posts, pages, and menus via a crafted request to "sitepress-multilingual-cms/menu/menus-sync.php"...

Code injection

admin/radera/tabort.asp in Hogstorps hogstorp guestbook 2.0 does not verify user credentials, which allows remote attackers to delete arbitrary posts via a modified delID parameter...

CVE-2006-2771: Undefined Security Weakness

admin/radera/tabort.asp in Hogstorps hogstorp guestbook 2.0 does not verify user credentials, which allows remote attackers to delete arbitrary posts via a modified delID parameter...