6071 matches found
CVE-2023-47762
CVE-2023-47762 affects WordPress BetterDocs plugin up to version 2.5.2, due to Missing Authorization via AJAX actions. Impact: unauthorized modification of documents for authenticated users with subscriber+ privileges (per Patchstack). Mitigation: upgrade to version 2.5.3 or later where fix is ap...
CVE-2023-47764
CVE-2023-47764 is a Missing Authorization vulnerability in the WordPress Ditty Ditty-news-ticker plugin. Affected versions are
CVE-2023-47776
CVE-2023-47776 affects the WordPress plugin miniorange otp verification (versions
CVE-2023-47793
CVE-2023-47793 affects the WordPress plugin Acme Fix Images . The vulnerability arises from missing authorization in the acme_fix_images_ajax_callback, enabling an authenticated user with at least subscriber-level access to resize images due to broken access control. Affected versions are
CVE-2023-47822
CVE-2023-47822 : WordPress plugin MP3 Audio Player for Music, Radio & Podcast by Sonaar has a Missing/Broken Access Control vulnerability. Affected versions are
CVE-2023-47823
CVE-2023-47823 is a WordPress FormCraft vulnerability described as a Missing Authorization/broken access control issue in FormCraft
CVE-2023-47826
CVE-2023-47826 corresponds to a Missing Authorization (Broken Access Control) vulnerability in the Restaurant & Cafe Addon for Elementor (WordPress) up to version 1.5.3. Unauthenticated attackers could modify data via multiple AJAX functions. Fixed in 1.5.4. Affected product/version: Restaurant &...
CVE-2023-47830
CVE-2023-47830 is a WordPress plugin vulnerability in Live Preview for Contact Form 7, affecting versions
CVE-2023-47836
CVE-2023-47836 affects the WP Meta and Date Remover plugin for WordPress, specifically versions
CVE-2023-47838
CVE-2023-47838 affects the WordPress plugin Conditional Fields for Contact Form 7 (cf7-conditional-fields). Root cause: Missing Authorization / Broken Access Control due to incorrectly configured access control levels, allowing exploitation by low-privilege users. Affected versions:
CVE-2023-47841
CVE-2023-47841 affects the WordPress plugin Analytify (
CVE-2023-47847
The CVE CVE-2023-47847 refers to a Missing Authorization vulnerability in the PayTR Taksit Tablosu WordPress plugin (WooCommerce integration). The vulnerability arises from incorrectly configured access control levels, i.e., a Broken Access Control issue that allows exploiting insufficient author...
CVE-2023-47849
CVE-2023-47849 affects the BlossomThemes Email Newsletter WordPress plugin. The issue is a Missing Authorization / Broken Access Control in the bten_get_mailing_list workflow, allowing unauthenticated access to mailing list data for versions up to and including 2.2.4. The vulnerability’s CVSS v3....
CVE-2023-47869
The CVE-2023-47869 issue concerns the WordPress plugin wpForo Forum, affected up to version 2.2.5. Connected data indicates a Content Injection/Broken Access Control vulnerability arising from improper handling of script-related HTML in web pages, enabling code injection. Patchstack specifies tha...
CVE-2023-48286
CVE-2023-48286 concerns the WordPress Stripe Payments plugin (Accept Stripe Payments) ≤ 2.0.79, with a Missing Authorization/ Broken Access Control vulnerability due to incorrectly configured access controls. Public-facing unauthenticated users could potentially exploit the issue due to unauthent...
CVE-2023-48774
CVE-2023-48774 affects the WordPress IdeaPush plugin (versions
CVE-2023-48776
CVE-2023-48776 affects the WordPress canvasio3D Light plugin (
CVE-2023-48779
CVE-2023-48779 pertains to WordPress 360 Javascript Viewer (plugin) with Broken Access Control via Missing Authorization. Affected versions are
CVE-2023-49158
CVE-2023-49158 affects the WordPress plugin LadiApp (LadiPage) and permits Stored XSS due to improper input neutralization during web page generation. Affected: LadiApp versions up to 4.4. Root cause: inadequate sanitization of input when generating pages. Impact: stored cross-site scripting coul...