PT-2025-39607

Name of the Vulnerable Software and Affected Versions HaruTheme Frames versions through 1.5.7 Description An authorization issue exists in HaruTheme Frames due to incorrectly configured access control security levels. This allows exploitation of the system. Recommendations Update HaruTheme Frames...

PT-2025-39597

Name of the Vulnerable Software and Affected Versions WP Virtual Assistant versions through 3.0 Description An authorization issue exists in WP Virtual Assistant, allowing exploitation of incorrectly configured access control security levels. Recommendations Update WP Virtual Assistant to a versi...

PT-2025-39529

Name of the Vulnerable Software and Affected Versions Acclectic Media Organizer versions through 1.4 Description An issue exists in Acclectic Media Organizer related to incorrectly configured access control security levels, allowing for missing authorization. Recommendations At the moment, there ...

PT-2025-39550

Name of the Vulnerable Software and Affected Versions CridioStudio ListingPro versions through 2.9.8 Description An authorization issue exists in CridioStudio ListingPro due to incorrectly configured access control security levels. This allows for exploitation of the system. Recommendations Updat...

CVE-2020-36851 Rob--W cors-anywhere Misconfigured CORS Proxy Allows SSRF

Rob--W cors-anywhere instances configured as an open proxy allow unauthenticated external users to induce the server to make HTTP requests to arbitrary targets SSRF. Because the proxy forwards requests and headers, an attacker can reach internal-only endpoints and link-local metadata services,...

CVE-2020-36851

CVE-2020-36851 affects cors-anywhere/server-side proxy configurations that run as an open proxy. The issue allows unauthenticated external users to induce the proxy to make HTTP requests to arbitrary targets (SSRF) because the proxy forwards requests and headers, enabling access to internal endpo...

Unspecified Vulnerability in WordPress Plugin Academy LMS

WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up a personal blog site on a PHP and MySQL based server.WordPress plugin is an application plugin. A security vulnerability exists in the WordPress plugin Academy LMS, which can be exploited by ...

CVE-2025-58221

Missing Authorization vulnerability in ONTRAPORT PilotPress pilotpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PilotPress: from n/a through = 2.0.36...

CVE-2025-58969

Missing Authorization vulnerability in Greg Winiarski Custom Login URL custom-login-url allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Login URL: from n/a through = 1.0.2...

CVE-2025-58668

Missing Authorization vulnerability in VibeThemes WPLMS wplms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPLMS : from n/a through = 4.970...

CVE-2025-59576

Missing Authorization vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS: from n/a through = 3.6.20...

CVE-2025-59581

Missing Authorization vulnerability in VW THEMES Ibtana ibtana-visual-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ibtana: from n/a through = 1.2.5.3...

CVE-2025-59551

Missing Authorization vulnerability in WP Chill Revive.so revive-so allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Revive.so: from n/a through = 2.0.6...

CVE-2025-57936

Missing Authorization vulnerability in Meitar Subresource Integrity SRI Manager wp-sri allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Subresource Integrity SRI Manager: from n/a through = 0.4.0...

CVE-2025-57976

Missing Authorization vulnerability in CardCom CardCom Payment Gateway woo-cardcom-payment-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CardCom Payment Gateway: from n/a through = 3.5.0.8...

CVE-2025-57987

Missing Authorization vulnerability in ThimPress WP Events Manager wp-events-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Events Manager: from n/a through = 2.2.1...

CVE-2025-57969

Missing Authorization vulnerability in Jeremy Saxey Hide WP Toolbar hide-wp-toolbar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hide WP Toolbar: from n/a through = 2.7...

CVE-2025-57961

Missing Authorization vulnerability in Codexpert, Inc CoDesigner woolementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CoDesigner: from n/a through = 4.29...

CVE-2025-57995

Missing Authorization vulnerability in Detheme DethemeKit For Elementor dethemekit-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DethemeKit For Elementor: from n/a through = 2.1.10...

WordPress Advanced Settings Plugin <= 3.1.1 - Arbitrary File Upload Vulnerability

Arbitrary File Upload Vulnerability discovered by R1sky in WordPress Plugin Advanced Settings versions = 3.1.1...