CVE-2024-12172: Missing Authorization

The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpcupdateusermetaoption function in all versions up to, and including, 3.2.21. This makes it...

CVE-2024-11709: Missing Authorization

The AI Post Generator | AutoWriter plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the aipostgeneratordeletePost AJAX action in all versions up to, and including, 3.5. This makes it possible for authenticated attackers, with...

PT-2024-16997

Name of the Vulnerable Software and Affected Versions de:branding plugin for WordPress versions up to and including 1.0.2 Description The issue allows unauthorized modification of data, potentially leading to privilege escalation due to a missing capability check on the debranding save function...

PT-2024-17198

Name of the Vulnerable Software and Affected Versions AI Post Generator | AutoWriter plugin for WordPress versions up to, and including, 3.5 Description The issue is related to a missing capability check on the ai post generator delete Post AJAX action. This allows authenticated attackers with...

PT-2024-17545 · WordPress · Essential Real Estate

Name of the Vulnerable Software and Affected Versions: Essential Real Estate plugin for WordPress versions up to and including 5.1.6 Description: The issue is related to a missing capability check on several pages and post types, allowing authenticated attackers with Contributor-level access and...

PT-2024-17469 · WordPress · Wp Courses Lms

Name of the Vulnerable Software and Affected Versions: WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress versions up to, and including, 3.2.21 Description: The issue is related to unauthorized access due to a missing capability...

PT-2024-17485 · WordPress · The Hash Form – Drag & Drop Form Builder

Name of the Vulnerable Software and Affected Versions: Hash Form – Drag & Drop Form Builder plugin for WordPress versions up to, and including, 1.2.1 Description: The issue is related to a missing capability check when creating form styles. This allows authenticated attackers with Contributor-lev...

CVE-2024-11205

The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpformsisadminpage' function in versions starting from 1.8.4 up to, and including, 1.9.2.1. This makes it possible for authenticated attackers, with Subscriber-level acces...

CVE-2024-11205

The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpformsisadminpage' function in versions starting from 1.8.4 up to, and including, 1.9.2.1. This makes it possible for authenticated attackers, with Subscriber-level acces...

CVE-2024-11205 WPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation

The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpformsisadminpage' function in versions starting from 1.8.4 up to, and including, 1.9.2.1. This makes it possible for authenticated attackers, with Subscriber-level acces...

CVE-2024-12253 Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal <= 3.1.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update / Data Access

The Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'savesettings', 'exportcsv', and 'simpleecommcart-action' actions in all versions up to, and including, 3.1.2. This makes it...

CVE-2024-12253

CVE-2024-12253 concerns the WordPress plugin “Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal” (versions up to 3.1.2). The issue is a missing capability check on actions including ‘save_settings’, ‘export_csv’, and ‘simpleecommcart-action’, which allows an attacker with subscr...

CVE-2024-7894: Missing Authorization

The If Menu plugin for WordPress is vulnerable to unauthorized modification of the plugin's license key due to a missing capability check on the 'actions' function in versions up to, and including, 0.19.1. This makes it possible for unauthenticated attackers to modify delete or modify the license...

CVE-2024-12026: Missing Authorization

The Message Filter for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveFilter function in all versions up to, and including, 1.6.3. This makes it possible for authenticated attackers, with Subscriber-level access...

PT-2024-16928

Name of the Vulnerable Software and Affected Versions SMS for Lead Capture Forms plugin for WordPress versions up to, and including, 1.1.0 Description The issue is caused by a missing capability check on the delete message function, allowing authenticated attackers with Subscriber-level access an...

CVE-2024-9706

The Ultimate Coming Soon & Maintenance plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ucsmactivatelitetemplatelite function in all versions up to, and including, 1.0.9. This makes it possible for unauthenticated attackers to change...

CVE-2024-9705

The Ultimate Coming Soon & Maintenance plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ucsmupdatetemplatenamelite' function in all versions up to, and including, 1.0.9. This makes it possible for authenticated attackers, with...

CVE-2024-12110 Gold Addons for Elementor <= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) License Activation/Deactivation

The Gold Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the activate and deactivate functions in all versions up to, and including, 1.3.2. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2024-9705 Ultimate Coming Soon & Maintenance <= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Template Name Update

The Ultimate Coming Soon & Maintenance plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ucsmupdatetemplatenamelite' function in all versions up to, and including, 1.0.9. This makes it possible for authenticated attackers, with...

CVE-2024-10578 Pubnews <= 1.0.7 - Authenticated (Subscriber+) Arbitrary Plugin Installation

The Pubnews theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the pubnewsimporterpluginactionfornotice function in all versions up to, and including, 1.0.7. This makes it possible for authenticated attackers, with Subscriber-level...