CVE-2023-51424

CVE-2023-51424 affects WebinarIgnition (WordPress Webinar plugin) up to version 3.05.0. The issue is an unauthenticated privilege escalation due to improper privilege management. Public details in Wordfence/EU listings show an in-the-wild risk with a CVSS v3.1 base score of 9.8 (CRITICAL), networ...

CVE-2023-51401

Technical details (affected version, root cause, exploit vectors, and patch status) for CVE-2023-51401 are not provided in the connected documents. Monitor vendor advisories and CVE records for updates and remediation specifics.

CVE-2023-51398

CVE-2023-51398 is an authentication‑related vulnerability in Brainstorm Force Ultimate Addons for Beaver Builder. The issue stems from improper privilege management that enables Privilege Escalation for authenticated users (Contributor+), potentially granting higher privileges than allowed. Affec...

CVE-2023-51356

CVE-2023-51356 corresponds to an Imp roper Privilege Management vulnerability in Repute Infosystems ARMember (WordPress plugin) affecting ARMember up to version 4.0.10. The issue allows Privilege Escalation for authenticated users (Subscriber+). The CVE details in connected sources indicate that ...

CVE-2023-50890

The CVE-2023-50890 entry concerns the WordPress plugin Ultimate Addons for Elementor (Brainstorm Force) up to version 1.36.20, affected by an Improper Privilege Management vulnerability that enables Privilege Escalation. Public sources consistently describe the impact as escalation of privileges ...

CVE-2023-48319

CVE-2023-48319 affects the WordPress plugin Salon booking system (salon-booking-system) up to version 8.6. It is an Improper Privilege Management vulnerability that enables Privilege Escalation for users with Editor-level access, potentially granting Administrator privileges. The issue is fixed i...

CVE-2023-47782

CVE-2023-47782 pertains to Thrive Theme Builder prior to version 3.24.0 and is an authenticated privilege-escalation vulnerability. Public documentation confirms that an authenticated user with Subscriber privileges could elevate their access due to improper privilege management in Thrive Theme B...

CVE-2023-47683

The CVE-2023-47683 entry concerns the miniOrange WordPress Social Login and Register plugin (Discord, Google, Twitter, LinkedIn). The root cause is improper privilege management that allows authenticated users with Subscriber access to escalate to Administrator. Affected versions are up to 7.6.6;...

CVE-2023-47682

CVE-2023-47682 affects the WordPress WP User Frontend plugin (versions ≤3.6.5). The issue is improper privilege management that allows authenticated users (author level and above) to escalate privileges, potentially enabling admin-level access via the registration_form function. The vulnerability...

CVE-2023-47679

CVE-2023-47679 describes a Local File Inclusion (path traversal) vulnerability in the WordPress plugin Qi Addons For Elementor by QODE Interactive. Affected versions are 1.6.3 and earlier; the issue stems from improper limitation of a pathname to a restricted directory, enabling inclusion of loca...

CVE-2023-46784

CVE-2023-46784 affects WordPress ICS Calendar plugin

CVE-2023-46205

CVE-2023-46205 : Local File Inclusion in the WordPress plugin Ultimate Addons for WPBakery Page Builder. Affected versions: up to 3.19.14. Root cause: improper limitation of a pathname to restricted directories (path traversal) leading to PHP Local File Inclusion. Impact (per CVE metrics): potent...

CVE-2023-46197

CVE-2023-46197: Path traversal vulnerability in Popup by Supsystic (WordPress plugin) allowing relative path traversal in versions up to 1.10.19. Exploitation path observed via getWpCsvList; unauthenticated access possible per Patchstack documenting arbitrary file download risk. Affected: Popup b...

CVE-2023-46145

CVE-2023-46145 is an authenticated privilege escalation in the WordPress theme Themify Ultra. The vulnerability arises from improper privilege management in Themify Ultra versions up to and including 7.3.5, enabling a subscriber-level attacker to escalate privileges. The issue is actively documen...

CVE-2023-45652

CVE-2023-45652: WordPress Remote Content Shortcode

CVE-2024-4789

CVE-2024-4789 : Cost Calculator Builder Pro for WordPress vulnerable to Server-Side Request Forgery (SSRF) via send_demo_webhook() in all versions up to 3.1.72. Exploitation requires authenticated access at subscriber level or higher, enabling the attacker to make outbound requests from the web a...

CVE-2023-44478

CVE-2023-44478 is a CSRF flaw in the WordPress plugin Events Rich Snippets for Google (

CVE-2024-24874

CVE-2024-24874 affects WordPress plugin CP Polls up to version 1.0.71, where unauthenticated content injection is possible due to insufficient validation of poll answers. The vulnerability is categorized as Content Injection with a low CVSS (5.3) and is mitigated by upgrading to version 1.0.72, w...

CVE-2024-25595

CVE-2024-25595 describes an Authentication Bypass by Spoofing in the Defender Security plugin for WordPress by WPMU DEV. Affected versions are Defender Security up to 4.4.1, with the underlying issue allowing an unauthenticated bypass of IP-based or functional protections, effectively enabling a ...

CVE-2024-25906

CVE-2024-25906 affects the WordPress plugin Comments Like Dislike (WP Happy Coders) up to version 1.2.2 . The issue is an authentication bypass via spoofing, specifically an IP restriction bypass that can allow functionality bypass/escalation of access as described in Patchstack and Red Hat/NVD r...