2153 matches found
CVE-2023-33998
CVE-2023-33998 affects the WordPress plugin Easy Social Icons (vulnerable:
CVE-2023-23472
CVE-2023-23472 affects IBM InfoSphere DataStage Flow Designer (InfoSphere Information Server 11.7). An authenticated user could obtain sensitive information that could aid further attacks. The vulnerability is described in IBM’s bulletin as an information-disclosure issue with a CVSS v3.1 base sc...
CVE-2023-41953
CVE-2023-41953 concerns the WordPress plugin ProfilePress (Membership Team) up to version 4.13.1, where a Missing Authorization vulnerability exists. The connected PT-2023-8991 document attributes the issue to a flaw in the admin_notice() path that enables a CSRF attack due to incorrect nonce val...
CVE-2023-48277
CVE-2023-48277 affects the WordPress plugin Super Progressive Web Apps (up to version 2.2.21). The vulnerability is a Broken Access Control caused by missing authorization in the newsletter submission AJAX path, allowing unauthenticated users to subscribe to the plugin author’s newsletter. The ve...
CVE-2023-22701
CVE-2023-22701 affects WordPress Ebook Store plugin (≤ 5.775). The root cause is Missing Authorization / Broken Access Control allowing unauthenticated access to ebook_store_export_orders, potentially exposing order data. NVD CVSSv3.1 base score is 9.8 (CRITICAL); patch notes indicate fix in v5.7...
CVE-2023-25714
CVE-2023-25714 — WordPress Quick Paypal Payments plugin : A Missing Authorization (Broken Access Control) vulnerability in Quick Paypal Payments (versions
CVE-2023-30870
CVE-2023-30870: Vulnerability in the WordPress plugin Sharkdropship for AliExpress Dropship and Affiliate (versions
CVE-2023-32117
CVE-2023-32117 affects the WordPress plugin Integrate Google Drive (versions n/a–1.1.99). The root cause is Missing Authorization due to missing capability checks on REST API endpoints, enabling unauthenticated attackers to perform operations (move files, create folders, copy details, etc.). The ...
CVE-2023-32299
CVE-2023-32299 affects the WordPress plugin Ni WooCommerce Sales Report (Ni WooCommerce Sales Report) up to version 3.7.3, due to Missing Authorization / Broken Access Control. Attackers with subscriber-level privileges could exploit an improperly enforced access control to view sales data. The v...
CVE-2023-47756
CVE-2023-47756 is a Missing Authorization (Broken Access Control) vulnerability in the Welcome Email Editor WordPress plugin. Affected versions are
CVE-2023-47760
CVE-2023-47760 affects WordPress WPDeveloper Essential Blocks for Gutenberg. The vulnerability is a Missing Authorization/Broken Access Control in Essential Blocks for Gutenberg versions
CVE-2023-47762
CVE-2023-47762 affects WordPress BetterDocs plugin up to version 2.5.2, due to Missing Authorization via AJAX actions. Impact: unauthorized modification of documents for authenticated users with subscriber+ privileges (per Patchstack). Mitigation: upgrade to version 2.5.3 or later where fix is ap...
CVE-2023-47764
CVE-2023-47764 is a Missing Authorization vulnerability in the WordPress Ditty Ditty-news-ticker plugin. Affected versions are
CVE-2023-47780
CVE-2023-47780 (EasyAzon WordPress plugin) is a Missing Authorization vulnerability in AJAX actions that affects EasyAzon versions
CVE-2023-47805
CVE-2023-47805: WordPress WPCafe plugin
CVE-2023-47820
CVE-2023-47820 affects WordPress WP Like Button
CVE-2023-47822
CVE-2023-47822 : WordPress plugin MP3 Audio Player for Music, Radio & Podcast by Sonaar has a Missing/Broken Access Control vulnerability. Affected versions are
CVE-2023-47826
CVE-2023-47826 corresponds to a Missing Authorization (Broken Access Control) vulnerability in the Restaurant & Cafe Addon for Elementor (WordPress) up to version 1.5.3. Unauthenticated attackers could modify data via multiple AJAX functions. Fixed in 1.5.4. Affected product/version: Restaurant &...