PT-2024-39013 · WordPress · Wp Easy Gallery

Name of the Vulnerable Software and Affected Versions: The WP Easy Gallery – WordPress Gallery Plugin versions up to, and including, 4.8.5 Description: The issue is related to unauthorized access due to a missing capability check on several functions hooked via AJAX, such as wpeg settings and wpe...

PT-2024-39157 · WordPress · Mycred

Name of the Vulnerable Software and Affected Versions: myCred – Loyalty Points and Rewards plugin for WordPress versions up to, and including, 2.7.3 Description: The issue allows unauthorized modification of data due to a missing capability check on the mycred update database function. This makes...

PT-2024-39172 · WordPress · Revolut Gateway For Woocommerce

Name of the Vulnerable Software and Affected Versions: Revolut Gateway for WooCommerce plugin for WordPress versions up to, and including, 4.17.3 Description: The issue is related to unauthorized modification of data due to a missing capability check on the "/wc/v3/revolut" REST API endpoint. Thi...

PT-2024-39011 · Themehunk · Easy Mega Menu Plugin

Name of the Vulnerable Software and Affected Versions: Easy Mega Menu Plugin for WordPress – ThemeHunk plugin versions up to, and including, 1.0.9 Description: The issue arises from a missing capability check on several functions hooked via AJAX, allowing authenticated attackers with...

PT-2024-39009 · WordPress · Webba Booking

Name of the Vulnerable Software and Affected Versions: The Appointment & Event Booking Calendar Plugin – Webba Booking plugin for WordPress versions up to, and including, 5.0.48 Description: The issue allows authenticated attackers with Subscriber-level access and above to modify the booking form...

CVE-2024-7888

The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions like exportforms, importforms, updatefboptions, and many more in all versions up to, and including, 3.1.7. This make...

CVE-2024-7727

The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions called via the 'h5vpajaxhandler' ajax action in all versions up to, and including, 2.5.32. This makes it possible fo...

CVE-2024-7727

The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions called via the 'h5vpajaxhandler' ajax action in all versions up to, and including, 2.5.32. This makes it possible fo...

CVE-2024-7721 HTML5 Video Player – mp4 Video Player Plugin and Block <= 2.5.34 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update

The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'savepassword' function in all versions up to, and including, 2.5.34. This makes it possible for authenticated attackers, wit...

CVE-2024-7721 HTML5 Video Player – mp4 Video Player Plugin and Block <= 2.5.34 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update

The HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'savepassword' function in all versions up to, and including, 2.5.34. This makes it possible for authenticated attackers, wit...

CVE-2024-7622

The Revision Manager TMC plugin for WordPress is vulnerable to unauthorized arbitrary email sending due to a missing capability check on the aajaxQuickEmailTestCallback function in all versions up to, and including, 2.8.19. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2024-7622 Revision Manager TMC <= 2.8.19 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending

The Revision Manager TMC plugin for WordPress is vulnerable to unauthorized arbitrary email sending due to a missing capability check on the aajaxQuickEmailTestCallback function in all versions up to, and including, 2.8.19. This makes it possible for authenticated attackers, with subscriber-level...

PT-2024-39004 · WordPress · Frontend Post Submission Manager Lite – Frontend Posting Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin versions up to, and including, 1.2.2 Description: The issue allows authenticated attackers with Subscriber-level access and above to update the plugin's settings an...

CVE-2024-7605

The HelloAsso plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'haajax' function in all versions up to, and including, 1.1.10. This makes it possible for authenticated attackers, with Contributor-level access and above, to update...

CVE-2024-7380

The Geo Controller plugin for WordPress is vulnerable to unauthorized menu creation/deletion due to missing capability checks on the ajaxgeolocatemenu and ajaxgeolocateremovemenu functions in all versions up to, and including, 8.6.9. This makes it possible for authenticated attackers, with...

CVE-2024-5309

The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the fvexportcsv, resetsettings, savesettings, savecolumnssettings, getanalyticsdata, geteventlogsdata, deletesubmissions, and...

CVE-2024-5309

The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the fvexportcsv, resetsettings, savesettings, savecolumnssettings, getanalyticsdata, geteventlogsdata, deletesubmissions, and...

PT-2024-38310 · WordPress · Geo Controller

Name of the Vulnerable Software and Affected Versions: Geo Controller plugin for WordPress versions up to, and including, 8.6.9 Description: The issue arises from missing capability checks on the ajax geolocate menu and ajax geolocate remove menu functions, allowing authenticated attackers with...

PT-2024-38446 · WordPress · Helloasso

Name of the Vulnerable Software and Affected Versions: HelloAsso plugin for WordPress versions up to, and including, 1.1.10 Description: The issue allows authenticated attackers with Contributor-level access and above to update plugin options, potentially disrupting the service, due to a missing...

PT-2024-37547 · Google · Google Calendar

Name of the Vulnerable Software and Affected Versions: Amelia Premium versions up to 7.7 Amelia Lite versions up to 1.2.3 Description: The issue is related to a missing capability check on the ameliaButtonCommand function, allowing unauthenticated attackers to access employee calendar details. In...