CVE-2024-9234: Missing Authorization

The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the installandactivatepluginfromexternal function install-active-plugin REST API endpoint in all versions up to,...

CVE-2024-9586: Missing Authorization

The Linkz.ai plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'checkauth' and 'checklogout' functions in versions up to, and including, 1.1.8. This makes it possible for unauthenticated attackers to update plugin settings...

CVE-2024-9707: Missing Authorization

The Hunk Companion plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the /wp-json/hc/v1/themehunk-import REST API endpoint in all versions up to, and including, 1.8.4. This makes it possible for unauthenticated attackers to...

CVE-2024-9685

The Notification for Telegram plugin for WordPress is vulnerable to unauthorized test message sending due to a missing capability check on the 'nftbtestaction' function in versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, with subscriber-level access and...

CVE-2024-9067: Missing Authorization

The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'deleteattachment' function in all versions up to, and including, 1.3.0. This makes i...

CVE-2024-8513: Missing Authorization

The QA Analytics – Web Analytics Tool with Heatmaps & Session Replay Across All Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxsavepluginconfig function in all versions up to, and including, 4.1.1.1. This makes it possibl...

CVE-2024-9065: Missing Authorization

The WP Helper Premium plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'whpsmtpsendmailtest' function in all versions up to, and including, 4.6.1. This makes it possible for unauthenticated attackers to send emails containing any...

CVE-2024-9520: Missing Authorization

The UserPlus plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 2.0. This makes it possible for authenticated attackers with subscriber-level permissions or above, ...

PT-2024-39704 · WordPress · Linkz.Ai

Name of the Vulnerable Software and Affected Versions: Linkz.ai plugin for WordPress versions up to, and including, 1.1.8 Description: The issue allows unauthorized modification of data due to a missing capability check on the ajax linkz function. This makes it possible for authenticated attacker...

Exploit for CVE-2023-30486

CVE-2023-30486 Square = 2.0.0 - Missing Authorization via...

PT-2024-39402 · WordPress · Youzify

Name of the Vulnerable Software and Affected Versions: The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress versions up to, and including, 1.3.0 Description: The issue allows authenticated attackers with Subscriber-level access and above to delete...

CVE-2024-8431

CVE-2024-8431 affects the WordPress plugin Robo Gallery (Photo Gallery, Images, Slider) up to version 3.2.21. The flaw is a missing capability check in ajaxGetGalleryJson(), allowing authenticated users with Subscriber+ privileges to retrieve private post titles. Public exploitation details are n...

CVE-2024-8431: Missing Authorization

The Photo Gallery, Images, Slider in Rbs Image Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajaxGetGalleryJson function in all versions up to, and including, 3.2.21. This makes it possible for authenticated attackers, with...

PT-2024-39008 · WordPress · Rbs Image Gallery

Name of the Vulnerable Software and Affected Versions: Rbs Image Gallery plugin for WordPress versions up to, and including, 3.2.21 Description: The issue is related to unauthorized access of data due to a missing capability check on the ajaxGetGalleryJson function. This allows authenticated...

CVE-2024-9161: Missing Authorization

The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'updatemetadata' function in all versions up to, and including, 1.0.228. This makes it possible for unauthenticated...

CVE-2024-8430

The Spice Starter Sites plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the spicestartersitesimportercreater function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to import demo conte...

CVE-2024-8430 Spice Starter Sites <= 1.2.5 - Missing Authorization to Unauthenticated Demo Content Import

The Spice Starter Sites plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the spicestartersitesimportercreater function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to import demo conte...

CVE-2024-8632: Missing Authorization

The KB Support – WordPress Help Desk and Knowledge Base plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'kbsajaxloadfrontendreplies' and 'kbsajaxmarkreplyasread' functions in all versions up to, and including, 1.6.6. This...

CVE-2024-8675: Missing Authorization

The Soumettre.fr plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the soumettredisconnectgateway function in all versions up to, and including, 2.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and...

PT-2024-39169 · WordPress · Soumettre.Fr

Name of the Vulnerable Software and Affected Versions: Soumettre.fr plugin for WordPress versions up to, and including, 2.1.2 Description: The issue allows authenticated attackers with Subscriber-level access and above to modify data without authorization due to a missing capability check on the...