Cross site scripting

The Flo Forms – Easy Drag & Drop Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Options Change by using the floimportformsoptions AJAX action in versions up to, and including, 1.0.35 due to insufficient input sanitization and output escaping along with missing...

Authorization

The GDPR Cookie Compliance plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the gdprcookiecomplianceresetsettings AJAX action in versions up to, and including, 4.0.2. This makes it possible for authenticated attackers to reset all of the settings...

CVE-2022-4948 FlyingPress <= 3.9.6 - Missing Authorization

The FlyingPress plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up to, and including, 3.9.6. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to interact with the plugin in...

CVE-2021-4341 uListing <= 1.6.6 - Unauthenticated Wordpress Options Changes via AJAX

The uListing plugin for WordPress is vulnerable to authorization bypass via Ajax due to missing capability checks, missing input validation, and a missing security nonce in the stmupdateemaildata AJAX action in versions up to, and including, 1.6.6. This makes it possible for unauthenticated...

CVE-2021-4341 uListing <= 1.6.6 - Unauthenticated Wordpress Options Changes via AJAX

The uListing plugin for WordPress is vulnerable to authorization bypass via Ajax due to missing capability checks, missing input validation, and a missing security nonce in the stmupdateemaildata AJAX action in versions up to, and including, 1.6.6. This makes it possible for unauthenticated...

CVE-2020-36697 WP GDPR <= 2.1.1 - Missing Authorization Checks

The WP GDPR plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in versions up to, and including, 2.1.1. This makes it possible for unauthenticated attackers to delete any comment and modify the plugin’s settings...

PT-2023-12490 · WordPress · Woocommerce Multi Currency

Name of the Vulnerable Software and Affected Versions: WooCommerce Multi Currency plugin for WordPress versions up to, and including, 2.1.17 Description: The issue is related to authorization bypass due to a missing capability check on the wmc bulk fixed price function. This allows authenticated...

PT-2023-12475 · WordPress · Jobsearch Wp Job Board

Name of the Vulnerable Software and Affected Versions: JobSearch WP Job Board plugin for WordPress versions up to, and including, 1.8.1 Description: The issue is related to a missing capability check on the jobsearch add job import schedule call function, allowing authenticated attackers to bypas...

PT-2023-12444 · WordPress · Ulisting

Name of the Vulnerable Software and Affected Versions: uListing plugin for WordPress versions up to, and including, 1.6.6 Description: The issue allows for authorization bypass via Ajax due to missing capability checks, missing input validation, and a missing security nonce in the stm update emai...

PT-2023-11368 · WordPress · Easy Wp Smtp

Name of the Vulnerable Software and Affected Versions: Easy WP SMTP plugin for WordPress versions up to, and including, 1.3.9 Description: The issue is due to missing capability checks on the admin init function, in addition to insufficient input validation. This allows unauthenticated attackers ...

PT-2023-12491

Name of the Vulnerable Software and Affected Versions Pinterest Automatic plugin for WordPress versions up to, and including, 1.14.3 Description The Pinterest Automatic plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the wp pinterest automatic parse...

PT-2023-23260 · Elementor · Elementor Pro

Name of the Vulnerable Software and Affected Versions: Elementor Pro versions up to, and including, 3.11.6 Description: The issue allows authenticated attackers with subscriber-level capabilities to update arbitrary site options, potentially leading to privilege escalation, due to a missing...

PT-2023-11857 · WordPress · Login/Signup Popup

Name of the Vulnerable Software and Affected Versions: Login/Signup Popup plugin for WordPress versions up to, and including, 1.4 Description: The issue is related to authorization bypass due to missing capability checks on several functions. This allows authenticated attackers to inject arbitrar...

PT-2023-12492 · WordPress · Ulisting

Name of the Vulnerable Software and Affected Versions: uListing plugin for WordPress versions up to, and including, 1.6.6 Description: The issue allows unauthorized access due to missing capability checks and a missing security nonce in the StmListingSingleLayout::import new layout method. This...

WordPress Plugin Quick Page/Post Redirect 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

PT-2023-11841 · WordPress · Quick Page/Post Redirect Plugin

Name of the Vulnerable Software and Affected Versions: The Quick Page/Post Redirect Plugin for WordPress versions up to, and including, 5.1.9 Description: The issue is related to authorization bypass due to missing capability checks on the qppr save quick redirect ajax and qppr delete quick...

PT-2023-23266 · WordPress · B2Bking

Name of the Vulnerable Software and Affected Versions: B2BKing plugin for WordPress versions up to, and including, 4.6.00 Description: The issue allows authenticated attackers with subscriber or customer-level permissions to modify the pricing of any product on the site due to a missing capabilit...

PT-2023-12440 · Woocommerce +1 · Improved Product Options For Woocommerce +15

Name of the Vulnerable Software and Affected Versions: Product Filter for WooCommerce versions prior to 8.2.0 Improved Product Options for WooCommerce versions prior to 5.3.0 Improved Sale Badges for WooCommerce versions prior to 4.4.0 Share, Print and PDF Products for WooCommerce versions prior ...

PT-2023-12495 · WordPress · Wp Quick Frontend Editor

Name of the Vulnerable Software and Affected Versions: WP Quick FrontEnd Editor plugin for WordPress versions up to and including 5.5 Description: The issue is related to page content injection due to missing capability checks in the plugin's page-editing functionality. This allows...

PT-2023-12461 · WordPress · Jobsearch Wp Job Board

Name of the Vulnerable Software and Affected Versions: JobSearch WP Job Board plugin for WordPress versions up to, and including, 1.8.1 Description: The issue is related to authorization bypass due to a missing capability check on the save locsettings function. This allows unauthenticated attacke...