PT-2025-1933 · WordPress · Rsvp/Event Management Plugin For Wordpress

Name of the Vulnerable Software and Affected Versions: RSVP and Event Management plugin for WordPress versions up to, and including, 2.7.13 Description: The issue allows unauthorized access due to a missing capability check on several AJAX functions, such as bulk delete attendees and bulk delete...

PT-2025-1950 · Aurum · Aurum

Name of the Vulnerable Software and Affected Versions: Aurum - WordPress & WooCommerce Shopping Theme versions prior to 4.0.3 Description: The issue concerns a missing capability check in the lab 1cl demo install package content function, allowing authenticated attackers with Subscriber-level...

PT-2025-1812

Name of the Vulnerable Software and Affected Versions Jupiter X Core plugin for WordPress versions up to, and including, 4.8.5 Description The issue is related to unauthorized access of data due to a missing capability check on the export popup action function. This allows unauthenticated attacke...

CVE-2024-12033: Missing Authorization

The Jupiter X Core plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the synclibraries function in all versions up to, and including, 4.8.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to sync libraries...

CVE-2024-12719: Missing Authorization

The WordPress File Upload plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wfuajaxactionreadsubfolders' function in all versions up to, and including, 4.24.15. This makes it possible for authenticated attackers, with Subscriber-level acce...

PT-2025-1662 · WordPress · Infility Global

Name of the Vulnerable Software and Affected Versions: Infility Global plugin for WordPress versions up to, and including, 2.9.8 Description: The issue allows authenticated attackers with Subscriber-level access and above to update plugin options, potentially breaking the site, due to a missing...

WordPress plugin Infility Global 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exist...

WordPress plugin WordPress File Upload 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2025-1589

Name of the Vulnerable Software and Affected Versions Spacer plugin for WordPress versions up to, and including, 3.0.7 Description The issue is related to unauthorized access of data due to a missing capability check on the motech spacer callback function. This allows authenticated attackers with...

CVE-2024-9697: Missing Authorization

The Social Rocket – Social Sharing Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tweetsettingssave and tweetsettingsupdate functions in all versions up to, and including, 1.3.4. This makes it possible for authenticated...

CVE-2024-11725: Missing Authorization

The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the updateWcWarrantySettings function in all versions up to, and including, 3.7.6. This makes it...

PT-2024-17584 · WordPress · The Marketking — Ultimate Woocommerce Multivendor Marketplace Solution

Name of the Vulnerable Software and Affected Versions: The MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress versions up to, and including, 2.0.00 Description: The issue is related to missing capability checks on several functions, including marketking delete...

CVE-2024-12413: Missing Authorization

The MarketKing — Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions like 'marketkingdeleteteammember', 'marketkingrejectuser', 'marketkingsaveprofilesettings', and many more in all...

CVE-2024-12881

The CVE affects PlugVersions – Easily rollback to previous versions of your plugins (WordPress plugin). Root cause: missing capability check in eos_plugin_reviews_restore_version() across all versions up to 0.0.7, enabling authenticated users with Subscriber+ privileges to create arbitrary files ...

CVE-2024-12594

CVE-2024-12594 concerns the WordPress plugin “Custom Login Page Styler” (ALL In One Custom Login Page family) where a missing capability check on AJAX action lps_generate_temp_access_url allows authenticated users with Subscriber+ privileges to impersonate other users. The CVE covers all versions...

CVE-2024-12266 ELEX WooCommerce Dynamic Pricing and Discounts <= 2.1.7 - Missing Authorization

The ELEX WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the elexdpexportrules and elexdpimportrules functions in all versions up to, and including, 2.1.7. This makes it possible for unauthenticated...

PT-2024-17669 · WordPress · Custom Login Page Styler – Login Protected Private Site

Name of the Vulnerable Software and Affected Versions: Custom Login Page Styler – Login Protected Private Site plugin for WordPress versions up to, and including, 7.1.1 Description: The issue is related to a missing capability check on the lps generate temp access url AJAX action. This allows...

CVE-2024-12266: Missing Authorization

The ELEX WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the elexdpexportrules and elexdpimportrules functions in all versions up to, and including, 2.1.7. This makes it possible for unauthenticated...

PT-2024-17675 · WordPress · Wc Price History For Omnibus

Name of the Vulnerable Software and Affected Versions: WC Price History for Omnibus plugin for WordPress versions up to, and including, 2.1.3 Description: The issue is related to unauthorized access due to a missing capability check on several AJAX actions. This allows authenticated attackers wit...

PT-2024-17773 · WordPress · Plugversions

Name of the Vulnerable Software and Affected Versions: PlugVersions plugin for WordPress versions up to, and including, 0.0.7 Description: The issue is related to a missing capability check on the eos plugin reviews restore version function, allowing authenticated attackers with Subscriber-level...