WordPress ClickWhale plugin <= 2.4.3 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability

Cross Site Request Forgery CSRF to Settings Change vulnerability discovered by Tran Nguyen Bao KhanhVCI - VNPT in WordPress Plugin ClickWhale versions = 2.4.3...

CVE-2025-26764 WordPress Distance Based Shipping Calculator plugin <= 2.0.22 - Settings Change vulnerability

Missing Authorization vulnerability in enituretechnology Distance Based Shipping Calculator distance-based-shipping-calculator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Distance Based Shipping Calculator: from n/a through = 2.0.22...

CVE-2025-26764 WordPress Distance Based Shipping Calculator plugin <= 2.0.22 - Settings Change vulnerability

Missing Authorization vulnerability in enituretechnology Distance Based Shipping Calculator distance-based-shipping-calculator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Distance Based Shipping Calculator: from n/a through = 2.0.22...

CVE-2025-0935

The Media Library Folders plugin for WordPress is vulnerable to unauthorized plugin settings change due to a missing capability check on several AJAX actions in all versions up to, and including, 8.3.0. This makes it possible for authenticated attackers, with Author-level access and above, to...

CVE-2025-0935 Media Library Folders <= 8.3.0 - Missing Authorization to Plugin Settings Change

The Media Library Folders plugin for WordPress is vulnerable to unauthorized plugin settings change due to a missing capability check on several AJAX actions in all versions up to, and including, 8.3.0. This makes it possible for authenticated attackers, with Author-level access and above, to...

CVE-2025-0935

CVE-2025-0935 concerns the WordPress plugin Media Library Folders (versions up to and including 8.3.0). The issue is a missing capability check on several AJAX actions, allowing authenticated attackers with Author-level access or higher to change plugin settings (e.g., IP-blocking). Impact is una...

CVE-2025-23771 WordPress Push Notification for Post and BuddyPress plugin <= 2.11 - Settings Change vulnerability

Missing Authorization vulnerability in Murali Push Notification for Post and BuddyPress push-notification-for-post-and-buddypress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Push Notification for Post and BuddyPress: from n/a through = 2.11...

CVE-2025-25143 WordPress GlobalQuran Plugin <= 1.0 - CSRF to Settings Change vulnerability

Cross-Site Request Forgery CSRF vulnerability in ibasit GlobalQuran globalquran allows Cross Site Request Forgery.This issue affects GlobalQuran: from n/a through = 1.0...

CVE-2025-25103 WordPress Indeed API Plugin <= 0.5 - CSRF to Settings Change vulnerability

Cross-Site Request Forgery CSRF vulnerability in bnielsen Indeed API allows Cross Site Request Forgery. This issue affects Indeed API: from n/a through 0.5...

CVE-2021-4368

The Frontend File Manager plugin for WordPress is vulnerable to Authenticated Settings Change in versions up to, and including, 18.2. This is due to lacking capability checks and a security nonce, all on the wpfmsavesettings AJAX action. This makes it possible for subscriber-level attackers to ed...

WordPress GlobalQuran Plugin <= 1.0 - CSRF to Settings Change vulnerability

CSRF to Settings Change vulnerability discovered by 0xd4rk5id3 in WordPress Plugin GlobalQuran versions = 1.0...

WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.7.2 - CSRF to Settings Change vulnerability

CSRF to Settings Change vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin VikBooking Hotel Booking Engine & PMS versions = 1.7.2...

WordPress WP Find Your Nearest Plugin <= 0.3.1 - CSRF to Settings Change vulnerability

CSRF to Settings Change vulnerability discovered by 0xd4rk5id3 in WordPress Plugin WP Find Your Nearest versions = 0.3.1...

CVE-2025-22265 WordPress EMI Calculator plugin <= 1.1 - Settings Change vulnerability

Missing Authorization vulnerability in mgplugin EMI Calculator emi-calculator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EMI Calculator: from n/a through = 1.1...

CVE-2025-22265

CVE-2025-22265 is a Missing Authorization vulnerability affecting mgplugin EMI Calculator (WordPress plugin). The connected Red Hat and PT Security sources specify a misconfiguration of access controls (Incorrectly Configured Access Control Security Levels) that enables exploitation due to insuff...

CVE-2025-22265 WordPress EMI Calculator plugin <= 1.1 - Settings Change vulnerability

Missing Authorization vulnerability in mgplugin EMI Calculator emi-calculator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EMI Calculator: from n/a through = 1.1...

CVE-2025-24724

CVE-2025-24724 refers to a CSRF vulnerability in the Wow-Company Side Menu Lite WordPress plugin, affecting versions up to 5.3.1. The issue enables Cross-Site Request Forgery to trigger settings changes. CVSS metrics shown (3.1 vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) indicate a Medium impact...

CVE-2025-24716 WordPress Herd Effects Plugin <= 6.2.1 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability

Cross-Site Request Forgery CSRF vulnerability in Wow-Company Herd Effects allows Cross Site Request Forgery. This issue affects Herd Effects: from n/a through 6.2.1...

CVE-2025-24716

CVE-2025-24716 is a CSRF to settings-change vulnerability in WordPress Herd Effects plugin (Wow-Company) affecting versions through 6.2.1. CVSS 3.1: Network, Low privileges, UI required, I/L/A partial/low/low, base 5.4. The connected sources indicate a fix exists but do not specify the exact patc...

CVE-2025-24717 WordPress Modal Window Plugin <= 6.1.4 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability

Cross-Site Request Forgery CSRF vulnerability in Wow-Company Modal Window modal-window allows Cross Site Request Forgery.This issue affects Modal Window: from n/a through = 6.1.4...