CVE-2025-10299 WPBifröst – Instant Passwordless Temporary Login Links <= 1.0.7 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

The WPBifröst – Instant Passwordless Temporary Login Links plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ctlcreatelink AJAX action in all versions up to, and including, 1.0.7. This makes it possible for authenticated attackers, with...

CVE-2025-10299

CVE-2025-10299 concerns the WPBifröst – Instant Passwordless Temporary Login Links plugin for WordPress. The root cause is a missing capability check on the ctl_create_link AJAX action, affecting all versions up to and including 1.0.7. This enables authenticated attackers with Subscriber-level ac...

EUVD-2025-34562

The WhyDonate – FREE Donate button – Crowdfunding – Fundraising plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the removerow function in all versions up to, and including, 4.0.14. This makes it possible for unauthenticated attackers to delete...

CVE-2025-10186

CVE-2025-10186 affects the WordPress plugin “WhyDonate – FREE Donate button – Crowdfunding – Fundraising”. The vulnerability is an unauthorized data loss due to a missing capability check in the remove_row function, applicable to all versions up to and including 4.0.14. Unauthenticated attackers ...

CVE-2025-11701: Missing Authorization

The Zip Attachments plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check as well as missing post status validation in the zacreatezipcallback function in all versions up to, and including, 1.6. This makes it possible for unauthenticated attackers to...

WordPress plugin Library Management System 安全漏洞

The WordPress Library Management System plugin is a plugin for extending the functionality of WordPress, mainly used to help users manage website content, user data and system settings more efficiently. The WordPress Library Management System plugin suffers from an unauthorized data modification...

CVE-2025-10303: Missing Authorization

The Library Management System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the owt7librarymanagementajaxhandler function in all versions up to, and including, 3.1. This makes it possible for authenticated attackers, with...

PT-2025-42311

Name of the Vulnerable Software and Affected Versions WordPress Zip Attachments plugin versions up to and including 1.6 Description The Zip Attachments plugin for WordPress has a flaw that allows unauthorized access to data. This is due to a missing capability check and a lack of post status...

CVE-2025-10648: Missing Authorization

The YourMembership Single Sign On – YM SSO Login plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'moymdisplaytestattributes' function in all versions up to, and including, 1.1.7. This makes it possible for unauthenticated attackers to rea...

PT-2025-42301

Name of the Vulnerable Software and Affected Versions YourMembership Single Sign On – YM SSO Login plugin for WordPress versions up to and including 1.1.7 Description The YourMembership Single Sign On – YM SSO Login plugin for WordPress has a flaw that allows unauthorized access to data. A missin...

CVE-2025-10186: Missing Authorization

The WhyDonate – FREE Donate button – Crowdfunding – Fundraising plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the removerow function in all versions up to, and including, 4.0.15. This makes it possible for unauthenticated attackers to delete...

PT-2025-42298

Name of the Vulnerable Software and Affected Versions Find And Replace content for WordPress plugin versions prior to 1.2 Description The Find And Replace content for WordPress plugin for WordPress is susceptible to unauthorized Stored Cross-Site Scripting and Arbitrary Content Replacement. This ...

PT-2025-42292

Name of the Vulnerable Software and Affected Versions WPBifröst versions through 1.0.7 Description The WPBifröst – Instant Passwordless Temporary Login Links plugin for WordPress has an issue that allows authenticated attackers with Subscriber-level access or higher to create new administrative...

WordPress Constructor plugin permission issue vulnerability

WordPress Constructor plugin is a framework for simplifying plugin development, mainly used to help developers quickly build and manage the plugin's components such as options pages, forms and custom fields. WordPress Constructor plugin suffers from a privilege issue vulnerability that stems from...

WordPress Cost Calculator Builder plugin unauthorized data modification vulnerability

WordPress Cost Calculator Builder plugin is a WordPress plugin for creating price estimation forms that supports quick generation of customized calculators via drag-and-drop form builder that can be embedded in website pages without programming. The WordPress Cost Calculator Builder plugin suffer...

CVE-2025-8682

The Newsup theme for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the newsupadmininfoinstallplugin function in all versions up to, and including, 5.0.10. This makes it possible for unauthenticated attackers to install the ansar-import plugin...

EUVD-2025-33847

The Newsup theme for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the newsupadmininfoinstallplugin function in all versions up to, and including, 5.0.10. This makes it possible for unauthenticated attackers to install the ansar-import plugin...

CVE-2025-8682

The Newsup theme for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the newsupadmininfoinstallplugin function in all versions up to, and including, 5.0.10. This makes it possible for unauthenticated attackers to install the ansar-import plugin...

CVE-2025-8593

CVE-2025-8593 affects the GSheetConnector For Gravity Forms WordPress plugin, with versions

CVE-2025-8682 Newsup <= 5.0.10 - Missing Authorization to Authenticated (Subscriber+) Plugin Installation

The Newsup theme for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the newsupadmininfoinstallplugin function in all versions up to, and including, 5.0.10. This makes it possible for unauthenticated attackers to install the ansar-import plugin...