643 matches found
CVE-2024-21751
CVE-2024-21751 concerns the WordPress plugin RabbitLoader up to version 2.19.13, where multiple AJAX actions lack proper authorization checks, allowing authenticated users with subscriber-level access and above to modify data (e.g., purge site cache or switch caching modes) without permission. Th...
CVE-2024-25929
CVE-2024-25929: WordPress plugin Product Catalog Enquiry for WooCommerce by MultiVendorX
CVE-2024-25092
CVE-2024-25092 is a Missing Authorization vulnerability in WordPress NextMove Lite (XLPlugins NextMove Lite) affecting all versions through 2.17.0. An authenticated user with subscriber-level privileges or higher can install and activate arbitrary plugins due to a missing capability check (xl_add...
CVE-2024-24716
Technical details about CVE-2024-24716 (Awesome Support Missing Authorization) are not publicly provided in the connected documents. No exploit, affected versions beyond 6.1.6, or remediation specifics are given. Monitor vendor advisories for updates.
CVE-2023-34003
CVE-2023-34003 affects the WooCommerce Box Office plugin (versions
CVE-2023-51494
CVE-2023-51494 is a Missing Authorization vulnerability in the WooCommerce Product Vendors plugin (WordPress). Affected versions are WooCommerce Product Vendors up to 2.2.1. Root cause: insufficient authorization checks allowing unauthenticated access to vendor-related actions. Impact in the NVD ...
CVE-2022-35718
CVE-2022-35718 affects IBM Sterling Partner Engagement Manager. The IBM bulletin states that the product stores sensitive information in URL parameters, which can be disclosed to unauthorized parties via server logs, referrer headers, or browser history. Affected versions: IBM Sterling Partner En...
CVE-2023-52147
CVE-2023-52147 concerns the WordPress plugin All In One WP Security & Firewall (AIOS)
CVE-2023-51543
CVE-2023-51543 describes an Authentication Bypass by Spoofing in the WordPress plugin RegistrationMagic (Metagauss) that allows bypassing ACL constraints to access restricted functionality. Affected versions are RegistrationMagic up to 5.2.5.0 (version range stated as n/a through 5.2.5.0). The vu...
CVE-2023-49748
CVE-2023-49748 affects the WP Hide Login plugin (WordPress) up to version 1.9.11. The vulnerability is described as a Secret Login Page Location Disclosure on multisite installations, enabling exposure of login functionality due to ACLs not constraining access as intended. It has a low overall im...
CVE-2023-49741
CVE-2023-49741 affects the WordPress plugin Coming Soon and Maintenance mode (
CVE-2023-48747
CVE-2023-48747 affects Booster for WooCommerce (WordPress plugin)
CVE-2023-48271
CVE-2023-48271 affects WordPress Maspik – Spam Blacklist plugin (legacy
CVE-2023-47769
CVE-2023-47769 affects WordPress WP Maintenance up to version 6.1.3. It describes an IP-filtering bypass that enables authentication bypass and access to constrained functionality. The CVSS v3.1 base score is 3.7 (Low); vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. Patchstack indicates th...
CVE-2023-47663
CVE-2023-47663 affects the WordPress plugin Foyer (WordPress plugin: Foyer – Digital Signage for WordPress). The issue is Improper Neutralization of Script-Related HTML Tags, resulting in Content Injection (basic XSS). Affected versions are Foyer up to 1.7.5. The vulnerability requires at least C...
CVE-2023-47189
CVE-2023-47189 affects WordPress Defender Security plugin versions
CVE-2024-31330
CVE-2024-31330 is listed in the 2024-11-01 Wear OS security bulletin under the System component with a local escalation-of-privilege (EoP) vulnerability (High severity). Affected software is Wear OS (System), with the issue mapped to AOSP version 13. The bulletin indicates exploitation could occu...
CVE-2024-5027
CVE-2024-5027 affects Citrix Workspace app for Mac (pre-2402.10). Elevation of privilege from a local authenticated user to root is possible. Remedy: upgrade to Citrix Workspace app for Mac 2402.10 or later (per CTX675851). If details on root-cause are not provided, note that explicit root-cause ...
CVE-2024-27971
CVE-2024-27971 is a path traversal causing unauthenticated local file inclusion in the WordPress plugin Premmerce Permalink Manager for WooCommerce . The issue affects versions from before 2.3.11 (i.e., up to 2.3.10) and stems from improper limitation of a pathname to a restricted directory. Publ...