620 matches found
CVE-2026-4133
The TextP2P Texting Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.7. This is due to missing nonce validation in the imTextP2POptionPage function which processes settings updates. The form at line 314 does not include a wpnoncefield,...
PT-2026-34309
Name of the Vulnerable Software and Affected Versions Google PageRank Display versions prior to 1.5 Description Cross-Site Request Forgery occurs due to missing nonce validation in the gpdisplay option function, which manages the plugin settings page. The settings form lacks a wp nonce field, and...
CVE-2026-2294
The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'uipsaveglobalsettings' function in all versions up to, and including, 3.5.09. This makes it possible for...
CVE-2026-25469 WordPress ViaBill – WooCommerce plugin <= 1.1.53 - Settings Change vulnerability
Missing Authorization vulnerability in ViaBill for WooCommerce ViaBill WooCommerce viabill-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ViaBill WooCommerce: from n/a through = 1.1.53...
CVE-2026-25469 WordPress ViaBill – WooCommerce plugin <= 1.1.53 - Settings Change vulnerability
Missing Authorization vulnerability in ViaBill for WooCommerce ViaBill – WooCommerce viabill-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ViaBill – WooCommerce: from n/a through = 1.1.53...
CVE-2026-25469
CVE-2026-25469 concerns ViaBill – WooCommerce (viabill-woocommerce) up to version 1.1.53, with a Missing Authorization vulnerability that allows unauthenticated changes to settings. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, base score 6.5 (Medium). The Wordfence report lists Mis...
CVE-2025-68032
CVE-2025-68032 (WordPress Advanced WC Analytics
CVE-2025-68026
CVE-2025-68026 affects the WordPress LC Wizard (GHL Wizard/Connector Wizard) plugin, with affected versions listed as 2.1.1 and earlier. The vulnerability is described as a Missing Authorization issue that allows unauthenticated setting updates due to incorrectly configured access control. Public...
WordPress Mega Store Woocommerce plugin <= 5.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation and Settings Change vulnerability
Missing Authorization to Authenticated Subscriber+ Arbitrary Page Creation and Settings Change vulnerability discovered by bugzy in WordPress Theme Mega Store Woocommerce versions = 5.9...
WordPress LC Wizard plugin <= 2.1.1 - Settings Change vulnerability
Settings Change vulnerability discovered by Legion Hunter in WordPress Plugin LC Wizard versions = 2.1.1...
WordPress Advanced WC Analytics plugin <= 3.19.0 - Settings Change vulnerability
Settings Change vulnerability discovered by Legion Hunter in WordPress Plugin Advanced WC Analytics versions = 3.19.0...
WordPress Addonify – Compare Products For WooCommerce plugin <= 1.1.17 - Settings Change vulnerability
Settings Change vulnerability discovered by Legion Hunter in WordPress Plugin Addonify Compare Products For WooCommerce versions = 1.1.17...
WordPress WebPurify Profanity Filter plugin <= 4.0.2 - Missing Authorization to Unauthenticated Plugin Settings Change via webpurify_save_options vulnerability
Missing Authorization to Unauthenticated Plugin Settings Change via webpurifysaveoptions vulnerability discovered by 0x34rth in WordPress Plugin WebPurify Profanity Filter versions = 4.0.2...
CVE-2025-69300 WordPress Premium Addons for Elementor plugin <= 4.11.63 - Settings Change vulnerability
Missing Authorization vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premium Addons for Elementor: from n/a through = 4.11.63...
CVE-2025-69300
The CVE CVE-2025-69300 concerns Leap13 Premium Addons for Elementor (plugin: premium-addons-for-elementor) with affected versions from n/a up to and including 4.11.63. The issue is a Missing Authorization vulnerability caused by incorrectly configured access control security levels, enabling unau...
CVE-2025-68003 WordPress Shown Connector plugin <= 1.2.10 - Settings Change vulnerability
Missing Authorization vulnerability in renatoatshown Shown Connector shown-connector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shown Connector: from n/a through = 1.2.10...
CVE-2025-68003 WordPress Shown Connector plugin <= 1.2.10 - Settings Change vulnerability
Missing Authorization vulnerability in renatoatshown Shown Connector shown-connector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shown Connector: from n/a through = 1.2.10...
CVE-2021-47754
Arunna 1.0.0 contains a cross-site request forgery vulnerability that allows attackers to manipulate user profile settings without authentication. Attackers can craft a malicious form to change user details, including passwords, email, and administrative privileges by tricking authenticated users...