CVE-2023-47840

CVE-2023-47840 Qode Essential Addons = 1.5.2 - Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Installation/Activation Description: The Qode Essential Addons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the...

CVE-2025-5288

🚨 REST API | Custom API Generator For Cross Platform And Import Export In WP 1.0.0 - 2.0.3 - Missing Authorization to Unauthenticated Privilege Escalation 📋 Description The REST API | Custom API Generator For Cross Platform And Import Export In WP plugin for WordPress is vulnerable to Privilege...

CVE-2023-3124

CVE-2023-3124 CVE-2023-3124 Proof of Concept This is a proof of concept PoC exploit for CVE-2023-3124, a vulnerability in WordPress Elementor Pro plugin. Description: The Elementor Pro plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the...

CVE-2024-12252

SEO LAT Auto Post = 2.2.1 - Remote Code Execution Description The SEO LAT Auto Post plugin for WordPress is vulnerable to file overwrite due to a missing capability check on the remoteupdate AJAX action in all versions up to, and including, 2.2.1. This makes it possible for unauthenticated...

CVE-2026-14566

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before updating WooCommerce order item metadata for a supplied order, allowing any authenticated user such as a subscriber to tamper with the custom metadata of orders belongi...

EUVD-2026-75962

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before saving popup configuration to a product, nor escape the stored values on output, allowing any authenticated user such as a subscriber to store JavaScript that executes ...

CVE-2026-14566

The advanced-customized-prompts WordPress plugin (versions ≤ 1.0.1 ) contains a missing authorization flaw: it performs no capability, ownership, or nonce check before updating WooCommerce order item metadata for a supplied order ID. This allows any authenticated user with the Subscriber role or ...

CVE-2024-12252

CVE-2024-12252 SEO LAT Auto Post = 2.2.1 - Missing Authorization to File Overwrite/Upload Remote Code Execution Description The SEO LAT Auto Post plugin for WordPress is vulnerable to file overwrite due to a missing capability check on the remoteupdate AJAX action in all versions up to, and...

CVE-2024-12471

CVE-2024-12471 Post Saint: ChatGPT, GPT4, DALL-E, Stable Diffusion, Pexels, Dezgo AI Text & Image Generator input type="hidden" name="...

CVE-2024-12594

CVE-2024-12594 ALL In One Custom Login Page...

CVE-2024-12535

CVE-2024-12535 Host PHP Info = 1.0.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure Description The Host PHP Info plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when including the 'phpinfo' function in all versions ...

EUVD-2026-75929

The Woo PDF Invoice Builder plugin also distributed as "PDF Builder for WooCommerce" for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder AJAX handler woocommerce-pdf-invoice-ajax.php:513, registered on...

CVE-2022-0236

CVE-2022-0236 The WP Import Export WordPress plugin is vulnerable to unauthenticated sensitive data disclosure due to a missing capability check on the download function wpieprocessfiledownload found in the /includes/classes/class-wpie-general.php file. This made it possible for unauthenticated...

CVE-2024-3553

CVE-2024-3553 Tutor LMS = 2.6.2 - Autorización faltante para actualización limitada de opciones no autenticada El plugin Tutor LMS – eLearning and online course solution para WordPress es vulnerable a la modificación no autorizada de datos debido a una falta de verificación de capacidades en la...

CVE-2026-15823

The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable function in versions up to, and including, 3.0.2. The wpajaxbacheetahdisable AJAX handler is registered without any capability or nonce...

EUVD-2026-75236

The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable function in versions up to, and including, 3.0.2. The wpajaxbacheetahdisable AJAX handler is registered without any capability or nonce...

PT-2026-89265

The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable function in versions up to, and including, 3.0.2. The wp ajax ba cheetah disable AJAX handler is registered without any capability or nonce...

CVE-2024-10586-Poc

Vulnerability Information Description The Debug Tool plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check on the dbtpullimage function and missing file type validation in all versions up to, and including, 2.2. This makes it possible for unauthenticated...

CVE-2024-54369

CVE-2024-54369 Zita Site Builder = 1.0.2 - Missing Authorization to Arbitrary Plugin Installation Description The Zita Site Builder plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on one of its functions in versions up to, and including...

CVE-2024-0679

CVE-2024-0679 ColorMag = 3.1.2 - Missing Authorization to Authenticated Subscriber+ Arbitrary Plugin Installation/Activation Description: The ColorMag theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the pluginactioncallback function in all versions up...