CVE-2024-21751

CVE-2024-21751 concerns the WordPress plugin RabbitLoader up to version 2.19.13, where multiple AJAX actions lack proper authorization checks, allowing authenticated users with subscriber-level access and above to modify data (e.g., purge site cache or switch caching modes) without permission. Th...

CVE-2024-25929

CVE-2024-25929: WordPress plugin Product Catalog Enquiry for WooCommerce by MultiVendorX

CVE-2024-25092

CVE-2024-25092 is a Missing Authorization vulnerability in WordPress NextMove Lite (XLPlugins NextMove Lite) affecting all versions through 2.17.0. An authenticated user with subscriber-level privileges or higher can install and activate arbitrary plugins due to a missing capability check (xl_add...

CVE-2024-24716

Technical details about CVE-2024-24716 (Awesome Support Missing Authorization) are not publicly provided in the connected documents. No exploit, affected versions beyond 6.1.6, or remediation specifics are given. Monitor vendor advisories for updates.

CVE-2023-34003

CVE-2023-34003 affects the WooCommerce Box Office plugin (versions

CVE-2023-51494

CVE-2023-51494 is a Missing Authorization vulnerability in the WooCommerce Product Vendors plugin (WordPress). Affected versions are WooCommerce Product Vendors up to 2.2.1. Root cause: insufficient authorization checks allowing unauthenticated access to vendor-related actions. Impact in the NVD ...

CVE-2024-21748

CVE-2024-21748 affects WordPress Icegram Engage plugin (Icegram) with versions up to 3.1.21. Root cause: Missing/Broken Authorization leading to unauthorized access. Patch 3.1.22 fixes the issue; severity reported as low (CVSS ~4.3).

CVE-2022-35718

CVE-2022-35718 affects IBM Sterling Partner Engagement Manager. The IBM bulletin states that the product stores sensitive information in URL parameters, which can be disclosed to unauthorized parties via server logs, referrer headers, or browser history. Affected versions: IBM Sterling Partner En...

CVE-2024-0444

CVE-2024-0444 concerns GStreamer and its AV1 parsing path. The flaw is a stack-based buffer overflow in the AV1 tile-list data parsing, caused by insufficient validation of the length of user-supplied data before copying to a fixed-size stack buffer. Exploitation can lead to remote arbitrary code...

GO-2024-2635 Mattermost incorrectly allows access individual posts in github.com/mattermost/mattermost-server

Mattermost incorrectly allows access individual posts in github.com/mattermost/mattermost-server...

CVE-2024-25095

CVE-2024-25095 affects WordPress plugin Easy Forms for Mailchimp (

CVE-2023-52147

CVE-2023-52147 concerns the WordPress plugin All In One WP Security & Firewall (AIOS)

CVE-2023-51543

CVE-2023-51543 describes an Authentication Bypass by Spoofing in the WordPress plugin RegistrationMagic (Metagauss) that allows bypassing ACL constraints to access restricted functionality. Affected versions are RegistrationMagic up to 5.2.5.0 (version range stated as n/a through 5.2.5.0). The vu...

CVE-2023-51511

CVE-2023-51511 involves Booster Elite for WooCommerce (Pluggabl LLC) with an improper authentication vulnerability that allows accessing functionality not properly constrained by ACLs. Affected software: Booster Elite for WooCommerce prior to version 7.1.3. Public references indicate a base CVSS ...

CVE-2023-49748

CVE-2023-49748 affects the WP Hide Login plugin (WordPress) up to version 1.9.11. The vulnerability is described as a Secret Login Page Location Disclosure on multisite installations, enabling exposure of login functionality due to ACLs not constraining access as intended. It has a low overall im...

CVE-2023-49741

CVE-2023-49741 affects the WordPress plugin Coming Soon and Maintenance mode (

CVE-2023-48747

CVE-2023-48747 affects Booster for WooCommerce (WordPress plugin)

CVE-2023-48318

CVE-2023-48318 is a CAPTCHA bypass vulnerability in WordPress plugin Contact Form Email (

CVE-2023-48271

CVE-2023-48271 affects WordPress Maspik – Spam Blacklist plugin (legacy

CVE-2023-47769

CVE-2023-47769 affects WordPress WP Maintenance up to version 6.1.3. It describes an IP-filtering bypass that enables authentication bypass and access to constrained functionality. The CVSS v3.1 base score is 3.7 (Low); vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. Patchstack indicates th...