GHSA-34P4-7W83-35G2 Formwork Improperly Managed Privileges in User creation

Summary The application fails to properly enforce role-based authorization during account creation. Although the system validates that the specified role exists, it does not verify whether the current user has sufficient privileges to assign highly privileged roles such as admin. As a result, an...

Formwork Improperly Managed Privileges in User creation

Summary The application fails to properly enforce role-based authorization during account creation. Although the system validates that the specified role exists, it does not verify whether the current user has sufficient privileges to assign highly privileged roles such as admin. As a result, an...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the REST API, Kargo’s authorization model fails to enforce the non-standard promote "dolphin verb" across three specific endpoints. While this sensitive operation is correctly gated in the legacy gRPC API, the...

CVE-2025-13563

The Lizza LMS Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.3. This is due to the 'lizzalmsproregisteruserfrontend' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to...

CVE-2025-12882

The Clasifico Listing plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.0. This is due to the plugin allowing users who are registering new accounts to set their own role by supplying the 'listinguserrole' parameter. This makes it possible for...

CVE-2025-13851

CVE-2025-13851 concerns Buyent Theme with Buyent Classified Plugin (

CVE-2025-13563

CVE-2025-13563 affects the Lizza LMS Pro plugin for WordPress, vulnerable in all versions up to 1.0.3 due to improper restriction in lizza_lms_pro_register_user_front_end, allowing unauthenticated attackers to supply the administrator role during registration and gain admin access. No remediation...

CVE-2025-13563 Lizza LMS Pro <= 1.0.3 - Unauthenticated Privilege Escalation

The Lizza LMS Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.3. This is due to the 'lizzalmsproregisteruserfrontend' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to...

CVE-2025-13563 Lizza LMS Pro <= 1.0.3 - Unauthenticated Privilege Escalation

The Lizza LMS Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.3. This is due to the 'lizzalmsproregisteruserfrontend' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to...

CVE-2026-0912 Toret Manager <= 1.2.7 - Authenticated (Subscriber+) Arbitrary Options Update via AJAX actions

The Toret Manager plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'trmansaveoption' function and on the 'trmansaveoptionitems' in all versions up to, and including, 1.2.7. This makes it possible...

CVE-2026-0912

CVE-2026-0912 concerns the WordPress plugin Toret Manager (versions up to 1.2.7). Wordfence notes an authenticated (Subscriber+) Arbitrary Options Update vulnerability via AJAX actions due to missing capability checks in trman_save_option and trman_save_option_items, enabling an attacker to updat...

CVE-2025-12882

CVE-2025-12882 relates to the Clasifico Listing plugin for WordPress. It affects versions up to and including 2.0, where unauthenticated users registering new accounts can set their own role via the listing_user_role parameter, enabling privilege escalation to the administrator role. The CVSS v3....

CVE-2025-12882 Clasifico Listing <= 2.0 - Unauthenticated Privilege Escalation

The Clasifico Listing plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.0. This is due to the plugin allowing users who are registering new accounts to set their own role by supplying the 'listinguserrole' parameter. This makes it possible for...

CVE-2025-12882 Clasifico Listing <= 2.0 - Unauthenticated Privilege Escalation

The Clasifico Listing plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.0. This is due to the plugin allowing users who are registering new accounts to set their own role by supplying the 'listinguserrole' parameter. This makes it possible for...

WordPress plugin Buyent Classified 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPres...

PT-2026-20629

Name of the Vulnerable Software and Affected Versions Toret Manager plugin for WordPress versions up to and including 1.2.7 Description The Toret Manager plugin for WordPress has a flaw that allows unauthorized modification of data, potentially leading to privilege escalation. This is due to a...

PT-2026-21344

Name of the Vulnerable Software and Affected Versions Formwork versions 2.0.0 through 2.3.3 Description Formwork is a flat file-based Content Management System CMS. The application does not properly enforce role-based authorization during account creation. Specifically, it does not verify if the...

PT-2026-42539

Name of the Vulnerable Software and Affected Versions LiteLLM versions prior to 1.83.10 Description An issue exists where the '/user/update' endpoint does not restrict which fields a user can modify when updating their own account. This allows a user to change their user role to proxy admin,...

WordPress plugin Clasifico Listing 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There ar...

WordPress plugin Lizza LMS Pro 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...