PT-2025-51437

Name of the Vulnerable Software and Affected Versions favethemes Homey Core versions through 2.4.3 Description An authorization issue exists in favethemes Homey Core. The issue involves incorrectly configured access control security levels, potentially allowing unauthorized access. The API...

PT-2025-51396

Name of the Vulnerable Software and Affected Versions emarket-design versions through 2.5.3 Description An authorization issue exists in the Request a Quote functionality of emarket-design. The issue involves incorrectly configured access control security levels, potentially allowing unauthorized...

PT-2025-51417

Name of the Vulnerable Software and Affected Versions Pochipp versions through 1.18.0 Description An authorization issue exists in Pochipp pochipp, allowing exploitation due to incorrectly configured access control security levels. Recommendations Update Pochipp to a version later than 1.18.0...

PT-2025-51397

Name of the Vulnerable Software and Affected Versions Protect WP Admin versions through 4.1 Description An authorization issue exists in Protect WP Admin, allowing exploitation of incorrectly configured access control security levels. Recommendations Update Protect WP Admin to a version newer tha...

PT-2025-51379

Name of the Vulnerable Software and Affected Versions WC Lovers WCFM – Frontend Manager for WooCommerce versions through 6.7.21 Description An authorization issue exists in WC Lovers WCFM – Frontend Manager for WooCommerce. The issue involves incorrectly configured access control security levels,...

PT-2025-51424

Name of the Vulnerable Software and Affected Versions merkulove Grider for Elementor versions through 1.0.8 Description An authorization issue exists in merkulove Grider for Elementor’s grider-elementor component. This allows exploitation due to incorrectly configured access control security...

PT-2025-51430

Name of the Vulnerable Software and Affected Versions merkulove Lottier versions through 1.1.1 Description An authorization issue exists in merkulove Lottier lottier-gutenberg, allowing exploitation of incorrectly configured access control security levels. Recommendations Update to a version late...

PT-2025-51428

Name of the Vulnerable Software and Affected Versions merkulove Lottier for WPBakery versions through 1.1.7 Description The software contains a missing authorization issue related to incorrectly configured access control security levels. This allows for exploitation of the access control...

PT-2025-51383

Name of the Vulnerable Software and Affected Versions ThemeNectar Salient Core versions through 3.0.8 Description An authorization issue exists in ThemeNectar Salient Core, allowing exploitation of incorrectly configured access control security levels. Recommendations Update ThemeNectar Salient...

WordPress FileBird – WordPress Media Library Folders & File Manager plugin <= 6.5.1 - Missing Authorization to Authenticated (Author+) Global Folders Tampering vulnerability

Missing Authorization to Authenticated Author+ Global Folders Tampering vulnerability discovered by type5afe in WordPress Plugin Filebird versions = 6.5.1...

CVE-2025-12900

The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 6.5.1 via the "ConvertController::insertToNewTable" function due to missing validation on a user controlled key. This makes it possible f...

CVE-2025-12900 FileBird – WordPress Media Library Folders & File Manager <= 6.5.1 - Missing Authorization to Authenticated (Author+) Global Folders Tampering

The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 6.5.1 via the "ConvertController::insertToNewTable" function due to missing validation on a user controlled key. This makes it possible f...

CVE-2025-12900

The CVE-2025-12900 entry concerns the WordPress FileBird plugin (FileBird – WordPress Media Library Folders & File Manager) with a vulnerability in all versions up to 6.5.1. Root cause: missing authorization in ConvertController::insertToNewTable due to insufficient validation on a user-controlle...

EUVD-2025-203366

The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 6.5.1 via the "ConvertController::insertToNewTable" function due to missing validation on a user controlled key. This makes it possible f...

CVE-2025-12696

The HelloLeads CRM Form Shortcode WordPress plugin through 1.0 does not have authorisation and CSRF check when resetting its settings, allowing unauthenticated users to reset them...

PT-2025-51222

The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 6.5.1 via the "ConvertController::insertToNewTable" function due to missing validation on a user controlled key. This makes it possible f...

CVE-2025-12696

The HelloLeads CRM Form Shortcode WordPress plugin through 1.0 does not have authorisation and CSRF check when resetting its settings, allowing unauthenticated users to reset them...

CVE-2025-12696

CVE-2025-12696 affects the WordPress HelloLeads CRM Form Shortcode plugin (versions

CVE-2025-14366

The Eyewear prescription form plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.0.1. This is due to missing authorization checks on the SubmitCatProductRequest AJAX action. This makes it possible for unauthenticated attackers to create arbitrary...

CVE-2025-14365

The Eyewear prescription form plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.0.1. This is due to missing capability checks on the RemoveItems AJAX action. This makes it possible for unauthenticated attackers to delete arbitrary WooCommerce...