Document Embedder < 1.7.9 - Subscriber+ Arbitrary Private/Draft Post Title Disclosure

The plugin contains a AJAX action endpoint, which could allow any authenticated user, such as subscriber to enumerate the title of arbitrary private and draft posts. PoC As any authenticated user 1764 being the ID of a private/draft post...

WordPress Document Embedder plugin <= 1.7.4 - Unauthenticated Arbitrary Private/Draft Post Title Disclosure vulnerability

Unauthenticated Arbitrary Private/Draft Post Title Disclosure vulnerability discovered by apple502j in WordPress Document Embedder plugin versions = 1.7.4. Solution Update the WordPress Document Embedder plugin to the latest available version at least 1.7.5...

CVE-2021-24635 Visual Link Preview < 2.2.3 - Unauthorised AJAX Calls

The Visual Link Preview WordPress plugin before 2.2.3 does not enforce authorisation on several AJAX actions and has the CSRF nonce displayed for all authenticated users, allowing any authenticated user such as subscriber to call them and 1 Get and search through title and content of Draft post, ...

Visual Link Preview < 2.2.3 - Unauthorised AJAX Calls

The plugin does not enforce authorisation on several AJAX actions and has the CSRF nonce displayed for all authenticated users, allowing any authenticated user such as subscriber to call them and 1 Get and search through title and content of Draft post, 2 Get title of a password-protected post as...