PT-2025-1797 · WordPress · Safe Ai Malware Protection For Wp

Name of the Vulnerable Software and Affected Versions: Safe Ai Malware Protection for WP plugin for WordPress versions up to, and including, 1.0.17 Description: The issue is related to unauthorized access of data due to a missing capability check on the export db function. This allows...

PT-2025-1759 · WordPress · Royal Core

Name of the Vulnerable Software and Affected Versions: Royal Core plugin for WordPress versions up to, and including, 2.9.2 Description: The issue allows authenticated attackers with Subscriber-level access and above to update arbitrary options on the WordPress site due to a missing capability...

PT-2025-2236 · WordPress · Ecpay Ecommerce For Woocommerce

Name of the Vulnerable Software and Affected Versions: ECPay Ecommerce for WooCommerce plugin for WordPress versions up to, and including, 1.1.2411060 Description: The issue is related to a missing capability check on the 'clear ecpay debug log' AJAX action. This allows authenticated attackers wi...

WordPress plugin MWB HubSpot for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2025-1664 · WordPress · Borderless – Widgets

Name of the Vulnerable Software and Affected Versions: Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress versions up to, and including, 1.5.9 Description: The issue is related to a missing capability check on the remove zipped font function,...

CVE-2024-13368

The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the youzifyofferbanner function in all versions up to, and including, 1.3.4. This makes it possible for...

CVE-2024-12113

The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the deleteuserreview and deletereview functions in all versions up to, and including, 1.3.2. This...

CVE-2024-12826

The CVE-2024-12826 flaw affects the GoHero Store Customizer for WooCommerce (WordPress). It stems from a missing capability check in the wooh_action_settings_save_frontend() function in all versions up to and including 3.5, enabling unauthenticated attackers to modify limited plugin settings. Imp...

CVE-2024-13370

CVE-2024-13370 affects Youzify (WordPress plugin) and is due to a missing capability check in save_addon_key_license(), enabling authenticated attackers with Subscriber+ privileges to update arbitrary options to a valid license key. Public details in Wordfence/Red Hat and CVE entries show the vul...

PT-2025-1752 · WordPress · Youzify – Buddypress Community

Name of the Vulnerable Software and Affected Versions: The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress versions up to, and including, 1.3.2 Description: The issue is related to unauthorized loss of data due to a missing capability check on the...

CVE-2024-13698

The Jobify - Job Board WordPress Theme for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the 'downloadimageviaai' and 'generateimageviaai' functions in all versions up to, and including, 4.2.7. This makes it possible for unauthenticat...

CVE-2024-13335

The Spexo Addons for Elementor – Free Elementor Addons, Widgets and Templates plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the tmpcoderthemeinstallfunc function in all versions up to, and including, 1.0.14. This makes it possible for authenticated...

CVE-2024-13335 Sastra Essential Addons for Elementor – Free Elementor Addons, Widgets and Templates <= 1.0.14 - Missing Authorization to Spexo Theme Install

The Spexo Addons for Elementor – Free Elementor Addons, Widgets and Templates plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the tmpcoderthemeinstallfunc function in all versions up to, and including, 1.0.14. This makes it possible for authenticated...

CVE-2024-12879

The WPBot Pro Wordpress Chatbot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'qcwplatestupdatecheckpro' function in all versions up to, and including, 13.5.5. This makes it possible for authenticated attackers, with...

CVE-2024-12104

The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wpfdeletefile and wpfdeletefile functions in all versions up to, and including, 4.0.9. This makes it possible for...

CVE-2024-12104

The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wpfdeletefile and wpfdeletefile functions in all versions up to, and including, 4.0.9. This makes it possible for...

CVE-2024-12104

CVE-2024-12104 documents a vulnerability in Visual Website Collaboration, Feedback & Project Management – Atarim (WordPress) where all versions up to 4.0.9 lack a required capability check on wpf_delete_file and wpf_delete_file functions. This permits unauthenticated attackers to delete project p...

CVE-2024-12104 Visual Website Collaboration, Feedback & Project Management – Atarim <= 4.0.9 - Missing Authorization to Authenticated (Subscriber+) Project Page/File Deletion

The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wpfdeletefile and wpfdeletefile functions in all versions up to, and including, 4.0.9. This makes it possible for...

CVE-2024-12071

The Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the deletenetworkpost function in all versions up to, and including, 1.4.4. This makes it possible for...

CVE-2024-12071 Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media <= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary Post Deletion

The Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the deletenetworkpost function in all versions up to, and including, 1.4.4. This makes it possible for...