CVE-2024-5864

The Easy Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the eaflresetsettings AJAX action in all versions up to, and including, 3.7.3. This makes it possible for authenticated attackers, with Subscriber-level access and...

CVE-2024-5864

CVE-2024-5864 concerns the Easy Affiliate Links WordPress plugin. The vulnerability arises from a missing capability check on the eafl_reset_settings AJAX action, allowing authenticated users with Subscriber-level access and above to modify the plugin’s settings in versions up to and including 3....

PT-2024-37203

Name of the Vulnerable Software and Affected Versions: Easy Affiliate Links plugin for WordPress versions up to, and including, 3.7.3 Description: The issue allows authenticated attackers with Subscriber-level access and above to modify data due to a missing capability check on the eafl reset...

CVE-2024-5863: Missing Authorization

The Easy Image Collage plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the ajaximagecollage function in all versions up to, and including, 1.13.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to...

PT-2024-37202

Name of the Vulnerable Software and Affected Versions: Easy Image Collage plugin for WordPress versions prior to 1.13.6 Description: The issue allows authenticated attackers with Contributor-level access and above to erase all content in arbitrary posts due to a missing capability check on the aj...

CVE-2024-3249: Missing Authorization

The Zita Elementor Site Library plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the importxmldata, xmldataimport, importoptiondata, importwidgets, and importcustomizersettings functions in all versions up to, and including, 1.6.2. This...

PT-2024-24612

Name of the Vulnerable Software and Affected Versions Zita Elementor Site Library plugin for WordPress versions up to, and including, 1.6.2 Description The issue allows authenticated attackers with subscriber-level access and above to modify data without proper authorization due to a missing...

CVE-2024-6120: Missing Authorization

The Sparkle Demo Importer plugin for WordPress is vulnerable to unauthorized database reset and demo data import due to a missing capability check on the multiple functions in all versions up to and including 1.4.7. This makes it possible for authenticated attackers, with Subscriber-level access...

CVE-2024-1955

The Hide Dashboard Notifications plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'warningnoticessettings' function in all versions up to, and including, 1.3. This makes it possible for authenticated attackers, with contributor acces...

CVE-2024-1955

CVE-2024-1955 affects the WordPress plugin Hide Dashboard Notifications (up to v1.3). Root cause: missing capability check in the warning_notices_settings function, enabling authenticated attackers with contributor+ rights to modify the plugin’s settings. Impact: unauthorized modification of data...

CVE-2024-3610

CVE-2024-3610 affects the WP Child Theme Generator plugin for WordPress. The underlying issue is a missing capability check in wctg_easy_child_theme(), allowing unauthenticated attackers to create a blank child theme and activate it, potentially whitescreening the site. Affected versions are all ...

CVE-2023-3352: Missing Authorization

The Smush plugin for WordPress is vulnerable to unauthorized deletion of the resmush list due to a missing capability check on the deleteresmushlist function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to delete the resmush list for Nextgen ...

PT-2024-37396

Name of the Vulnerable Software and Affected Versions: Sparkle Demo Importer plugin for WordPress versions up to and including 1.4.7 Description: The issue arises from a missing capability check on multiple functions, allowing authenticated attackers with Subscriber-level access and above to...

CVE-2024-3961: Missing Authorization

The ConvertKit – Email Newsletter, Email Marketing, Subscribers and Landing Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tagsubscriber function in all versions up to, and including, 2.4.9. This makes it possible for...

CVE-2024-1639: Missing Authorization

The License Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the showLicenseKey and showAllLicenseKeys functions in all versions up to, and including, 3.0.6. This makes it possible for authenticated attackers, with admi...

CVE-2024-3610: Missing Authorization

The WP Child Theme Generator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wctgeasychildtheme function in all versions up to, and including, 1.1.1. This makes it possible for unauthenticated attackers to create a blank child theme...

PT-2024-18449

Name of the Vulnerable Software and Affected Versions Hide Dashboard Notifications plugin for WordPress versions up to, and including, 1.3 Description The issue is related to a missing capability check on the warning notices settings function, allowing authenticated attackers with contributor...

PT-2024-26848 · WordPress · Promolayer

Name of the Vulnerable Software and Affected Versions: Promolayer plugin for WordPress versions up to, and including, 1.1.0 Description: The Promolayer plugin for WordPress is affected by an issue that allows unauthorized updates to plugin settings. This is due to a missing capability check on th...

CVE-2024-3627: Missing Authorization

The Wheel of Life: Coaching and Assessment Tool for Life Coach plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on several functions in the AjaxFunctions.php file in all versions up to, and including, 1.1.7. This makes it possible...

CVE-2024-5768: Missing Authorization

The MIMO Woocommerce Order Tracking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mimoupdateprovider' function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level...