CVE-2025-1668

The School Management System – WPSchoolPress plugin for WordPress is vulnerable to arbitrary user deletion due to a missing capability check on the wpspDeleteUser function in all versions up to, and including, 2.2.16. This makes it possible for authenticated attackers, with teacher-level access a...

CVE-2024-12336

The WC Affiliate – A Complete WooCommerce Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'exportalldata' function in all versions up to, and including, 2.5.3. This makes it possible for authenticated attackers, with...

CVE-2025-1668

CVE-2025-1668 concerns the WordPress plugin WPSchoolPress (School Management System) for versions

CVE-2025-1668 School Management System – WPSchoolPress <= 2.2.16 - Missing Authorization to Arbitrary User Deletion

The School Management System – WPSchoolPress plugin for WordPress is vulnerable to arbitrary user deletion due to a missing capability check on the wpspDeleteUser function in all versions up to, and including, 2.2.16. This makes it possible for authenticated attackers, with teacher-level access a...

CVE-2025-1657

CVE-2025-1657 concerns the Directory Listings WordPress plugin – uListing for WordPress. The Red Hat and NVD entries, plus Wordfence details, state that all versions up to and including 2.1.7 are vulnerable due to a missing capability check on the stm_listing_ajax AJAX action. This allows authent...

PT-2025-11316

Name of the Vulnerable Software and Affected Versions: The WC Affiliate – A Complete WooCommerce Affiliate Plugin versions up to, and including, 2.5.3 Description: The issue allows unauthorized access to data due to a missing capability check on the export all data function. This makes it possibl...

PT-2025-11319

Name of the Vulnerable Software and Affected Versions: The School Management System – WPSchoolPress plugin for WordPress versions up to, and including, 2.2.16 Description: The issue is related to a missing capability check on the wpsp DeleteUser function, allowing authenticated attackers with...

PT-2025-11324

Name of the Vulnerable Software and Affected Versions: WP01 plugin for WordPress versions up to, and including, 2.6.2 Description: The issue allows authenticated attackers with Subscriber-level access and above to download and read the contents of arbitrary files on the server, which can contain...

PT-2025-11333

Name of the Vulnerable Software and Affected Versions: The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress versions prior to 3.22.1 Description: The issue is related to unauthorized access of data due to a missing capability check on the give reports earnings function. This...

CVE-2025-2025: Missing Authorization

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the givereportsearnings function in all versions up to, and including, 3.22.0. This makes it possible for unauthenticated attackers to...

CVE-2024-12336: Missing Authorization

The WC Affiliate – A Complete WooCommerce Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'exportalldata' function in all versions up to, and including, 2.5.3. This makes it possible for authenticated attackers, with...

CVE-2025-1507

The ShareThis Dashboard for Google Analytics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handleactions function in all versions up to, and including, 3.2.1. This makes it possible for unauthenticated attackers to disable all...

CVE-2025-1507

CVE-2025-1507 is a genuine vulnerability in the WordPress plugin ShareThis Dashboard for Google Analytics (WordPress). All versions up to and including 3.2.1 are affected due to a missing capability check in the function handle_actions(), allowing unauthenticated attackers to disable features or ...

CVE-2025-2103

The SoundRise Music plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on theironMusicajax function in all versions up to, and including, 1.6.11. This makes it possible for authenticated attackers, with...

CVE-2025-0952 Eco Nature - Environment & Ecology WordPress Theme <= 2.0.4 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update

The Eco Nature - Environment & Ecology WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'cmsmastershideadminnotice' AJAX action in all versions up to, and including, 2.0.4. This mak...

CVE-2025-0955 VidoRev Extensions <= 2.9.9.9.9.9.5 - Missing Authorization to Unauthenticated Youtube Video Import

The VidoRev Extensions plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'vidorevimportsinglevideo' AJAX action in all versions up to, and including, 2.9.9.9.9.9.5. This makes it possible for unauthenticated attackers to import arbitrary youtube...

PT-2025-11237

Name of the Vulnerable Software and Affected Versions: The Resido - Real Estate WordPress Theme versions up to, and including, 3.6 Description: The issue is related to unauthorized access due to a missing capability check on the delete api key and save api key AJAX actions. This allows...

PT-2025-11238

Name of the Vulnerable Software and Affected Versions: Search & Filter Pro plugin for WordPress versions prior to 2.5.20 Description: The issue allows unauthorized access to data due to a missing capability check on the get meta values function. This makes it possible for authenticated attackers,...

PT-2025-11252

Name of the Vulnerable Software and Affected Versions: ShareThis Dashboard for Google Analytics plugin for WordPress versions up to, and including, 3.2.1 Description: The issue allows unauthorized modification of data due to a missing capability check on the handle actions function. This makes it...

PT-2025-11243

Name of the Vulnerable Software and Affected Versions: The Eco Nature - Environment & Ecology WordPress Theme versions up to, and including, 2.0.4 Description: The issue allows authenticated attackers with Subscriber-level access and above to modify data, potentially leading to a denial of servic...