CVE-2025-13558 Blog2Social <= 8.7.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Trashing

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'deleteUserCcDraftPost' function in all versions up to, and including, 8.7.0. This makes it possible for authenticated attackers, wi...

CVE-2025-54347

creationtimestamp| type| source ---|---|--- 2025-11-25 01:35:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m6g7algqeb2j 2025-11-25 01:45:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m6g7r7juww2n 2025-11-25 04:33:13+00:00| seen|...

CVE-2025-13558: Missing Authorization

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'deleteUserCcDraftPost' function in all versions up to, and including, 8.7.0. This makes it possible for authenticated attackers, wi...

PT-2025-47983

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'deleteUserCcDraftPost' function in all versions up to, and including, 8.7.0. This makes it possible for authenticated attackers, wi...

CVE-2025-13466

creationtimestamp| type| source ---|---|--- 2025-11-24 18:40:14+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3m6fhz63cvk2n 2025-11-24 18:44:17+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3m6fiagi6fc2n...

CVE-2025-13384

creationtimestamp| type| source ---|---|--- 2025-11-22 09:02:58+00:00| seen| https://infosec.exchange/users/offseq/statuses/115592539421607125 2025-11-22 09:02:59+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3m67gvblmzx27 2025-11-22 09:44:18+00:00| seen|...

CVE-2025-64720

creationtimestamp| type| source ---|---|--- 2025-11-22 00:33:44+00:00| seen| https://seclists.org/oss-sec/2025/q4/204 2025-11-22 01:59:06+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3m66p54ip7t2h 2025-11-22 02:34:48+00:00| seen|...

CVE-2025-64505

creationtimestamp| type| source ---|---|--- 2025-11-22 00:33:44+00:00| seen| https://seclists.org/oss-sec/2025/q4/204 2025-11-22 01:59:05+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3m66p54ip7t2h 2025-11-22 02:34:48+00:00| seen|...

CVE-2025-12877: Missing Authorization

The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized modification od data due to a missing capability check on the pandingbloodrequestaction function in all versions up to, and including, 2.1.15. This makes it possible for...

CVE-2025-64695

creationtimestamp| type| source ---|---|--- 2025-11-21 07:08:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m64pyg63n62x 2025-11-21 07:32:50+00:00| seen| https://infosec.exchange/users/offseq/statuses/115586522750052262 2025-11-21 07:32:52+00:00| seen|...

CVE-2025-64310

creationtimestamp| type| source ---|---|--- 2025-11-21 03:03:09+00:00| seen| https://infosec.exchange/users/offseq/statuses/115585462301435855 2025-11-21 03:03:11+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3m64cbiaajw2l 2025-11-21 03:26:50+00:00| seen|...

CVE-2025-49752

creationtimestamp| type| source ---|---|--- 2025-11-20 22:41:55+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115584435147386291 2025-11-20 23:40:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m63wvrieng2u 2025-11-20 23:45:08+00:00| seen|...

WordPress Like-it plugin cross-site request forgery vulnerability

WordPress Like-it plugin is an extension to add like-it functionality to WordPress blogs, allowing users to perform like-it operations on posts or comments. The WordPress Like-it plugin suffers from a cross-site request forgery vulnerability, which arises from a web application that does not...

CVE-2023-41347

creationtimestamp| type| source ---|---|--- 2025-11-19 21:59:29+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115578606002979278 2025-11-19 22:00:06+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115578608301178805 2025-11-20 21:02:47+00:00| seen|...

CVE-2025-12481

The WP Duplicate Page plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.7. This is due to the plugin not properly verifying that a user is authorized to perform an action in the 'saveSettings' function. This makes it possible for authenticated...

CVE-2025-12524

The Post Type Switcher plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.0 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to modify the post type...

GO-2025-4129 Mattermost allows an attacker to edit arbitrary posts via a crafted MSTeams plugin OAuth redirect URL in github.com/mattermost/mattermost-server

Mattermost allows an attacker to edit arbitrary posts via a crafted MSTeams plugin OAuth redirect URL in github.com/mattermost/mattermost-server...

EUVD-2025-197964

The WP Duplicate Page plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.7. This is due to the plugin not properly verifying that a user is authorized to perform an action in the 'saveSettings' function. This makes it possible for authenticated...

CVE-2025-12481

The WP Duplicate Page plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.7. This is due to the plugin not properly verifying that a user is authorized to perform an action in the 'saveSettings' function. This makes it possible for authenticated...

CVE-2025-12481 WP Duplicate Page <= 1.7 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure

The WP Duplicate Page plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.7. This is due to the plugin not properly verifying that a user is authorized to perform an action in the 'saveSettings' function. This makes it possible for authenticated...