CVE-2023-4800

CVE ID: CVE-2023-4800 Vulnerability Type: Sensitive Data Exposure Description: The DoLogin Security plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the dashboard widget in versions up to, and including, 3.7. This makes it possible for...

CVE-2023-47840

CVE-2023-47840 Qode Essential Addons = 1.5.2 - Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Installation/Activation Description: The Qode Essential Addons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the...

CVE-2026-3891

CVE-2026-3891 Pix for WooCommerce If protocol is missing → scri...

CVE-2024-43918

Wordpress WBW Product Table Pro = 1.9.4 - Unauthenticated Arbitrary SQL Execution to Remote Code Execution CVE-2024-43918 The WBW Product Table Pro plugin for WordPress is vulnerable to unauthorized arbitrary SQL Execution due to a missing capability check on a function in all versions up to, and...

WordPress Reset Database plugin <= 1.1.3 - Authenticated (Subscriber+) Privilege Escalation to Missing Capability and Nonce Check in process_reset() vulnerability

Authenticated Subscriber+ Privilege Escalation to Missing Capability and Nonce Check in processreset vulnerability discovered by Robert Huzo HuzoSecurity in WordPress Plugin Reset Database versions = 1.1.3...

CVE-2024-1380

CVE-2024-1380 Relevanssi – A Better Search = 4.22.0 - Missing Authorization to Unauthenticated Query Log Export Description The Relevanssi – A Better Search plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the relevanssiexportlogcheck function...

CVE-2026-119303

The NotificationX WordPress plugin before 3.3.7 does not perform any capability or nonce check on one of its REST routes, allowing unauthenticated users to update a NotificationX WordPress plugin before 3.3.7 option and to repeatedly trigger emails sent through the site's own mail server...

Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit - Broken Access Control

The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the installoractivateaddonplugins function and a weak nonce hash in all...

CVE-2024-10578

CVE-2024-10578: Pubnews = 1.0.7 - Unauthenticated Arbitrary Plugin Installation Description The Pubnews theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the pubnewsimporterpluginactionfornotice function in all versions up to, and...

CVE-2024-7135

CVE-2024-7135 The Tainacan plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getfile' function in all versions up to, and including, 0.21.7. The function is also vulnerable to directory traversal. This makes it possible for authenticated...

CVE-2024-54239

CVE-2024-54239 Eyewear prescription form = 4.0.18 - Missing Authorization to Unauthenticated Arbitrary Options Update Description The Eyewear prescription form plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability...

CVE-2024-3553

CVE-2024-3553 Tutor LMS = 2.6.2 - Missing Authorization to Unauthenticated Limited Options Update The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the hidenotices function in all...

CVE-2022-0236

CVE-2022-0236 The WP Import Export WordPress plugin is vulnerable to unauthenticated sensitive data disclosure due to a missing capability check on the download function wpieprocessfiledownload found in the /includes/classes/class-wpie-general.php file. This made it possible for unauthenticated...

CVE-2024-12252

CVE-2024-12252 SEO LAT Auto Post = 2.2.1 - Missing Authorization to File Overwrite/Upload Remote Code Execution Description The SEO LAT Auto Post plugin for WordPress is vulnerable to file overwrite due to a missing capability check on the remoteupdate AJAX action in all versions up to, and...

CVE-2024-56071

🚨 Simple Dashboard = 2.0 - Unauthenticated Privilege Escalation 📄 Description The Simple Dashboard plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0. This makes it possible for unauthenticated attackers to elevate their privileges to that of an...

CVE-2024-10629

🛠️ GPX Viewer Exploit CVE-2024-10629 This repository contains a proof-of-concept exploit for the GPX Viewer plugin for WordPress, which is vulnerable to arbitrary file creation CVE-2024-10629. The vulnerability allows authenticated attackers with subscriber-level access and above to create...

CVE-2024-12594

CVE-2024-12594 ALL In One Custom Login Page...

CVE-2024-56067

CVE-2024-56067 WP SuperBackup = 2.3.3 - Missing Authorization to Unauthenticated Back-Up File Download Description The Super Backup & Clone - Migrate for WordPress plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and...

CVE-2022-1329

CVE-2022-1329 The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the /core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in addition to uploading...

CVE-2024-54369

CVE-2024-54369 Zita Site Builder = 1.0.2 - Missing Authorization to Arbitrary Plugin Installation Description The Zita Site Builder plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on one of its functions in versions up to, and including...