Download canvasio3D Light <= 2.5.0 - Subscriber+ Entries Update/Deletion

Description The plugin is vulnerable to unauthorized access & modification of data due to a missing capability check on the caARConnect function, allowing authenticated attackers, with subscriber-level access and above, to retrieve data from the plugin and save/delete entries...

Booster for WooCommerce < 7.1.2 - Missing Authorization to Authenticated (Subscriber+) Order Information Disclosure

Description The Booster for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the initatts function in all versions up to, and including, 7.1.1. This makes it possible for authenticated attackers, with subscriber-level access and...

Awesome Support < 6.1.5 - Missing Authorization via wpas_edit_reply_ajax()

Description The Awesome Support plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpaseditreplyajax function in versions up to, and including, 6.1.4. This makes it possible for authenticated attackers, with subscriber-level access and...

Visitors Traffic Real Time Statistics <= 7.2 - Missing Authorization via multiple AJAX actions

Description The Visitors Traffic Real Time Statistics plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple AJAX functions in versions up to, and including, 7.2. This makes it possible for authenticated attackers, with subscriber-level...

Unyson <= 2.7.28 - Missing Authorization

Description The Unyson plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on several functions in versions up to, and including, 2.7.28. This makes it possible for authenticated attackers, with subscriber-level access and above, to...

Glossary <= 3.1.2 - Missing Authorization

Description The Glossary plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on an unknown function in versions up to, and including, 3.1.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to make us...

Bulk NoIndex & NoFollow Toolkit < 1.51 - Missing Authorization

Description The Bulk NoIndex & NoFollow Toolkit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the updatepagecallback and updatepagebulkcallback functions called via AJAX actions in versions up to, and including, 1.5. This makes it...

Ni WooCommerce Sales Report <= 3.7.3 - Missing Authorization via ajax_sales_order

Description The Ni WooCommerce Sales Report plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ajaxsalesorder' function in versions up to, and including, 3.7.3. This makes it possible for authenticated attackers, with subscriber-level acces...

Inactive Logout < 3.2.3 - Missing Authorization

Description The Inactive Logout plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the inaresetadvsettings function in versions up to, and including, 3.2.2. This makes it possible for authenticated attackers, with subscriber-level access a...

TelSender <= 1.14.8 - Missing Authorization

Description The TelSender plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tscfwcformajaxreqest function hooked via an AJAX action in versions up to, and including, 1.14.8. This makes it possible for authenticated attackers, with...

Dragfy Addons for Elementor <= 1.0.2 - Missing Authorization via save_settings

Description The Dragfy Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the savesettings function in versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with subscriber-level...

AI ChatBot < 4.9.1 and 4.9.2 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File Write via qcld_openai_upload_pagetraining_file

Description The AI ChatBot for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.8.9 as well as 4.9.2 via the qcldopenaiuploadpagetrainingfile function. This allows subscriber-level attackers to append "...

10Web Map Builder for Google Maps < 1.0.74 - Missing Authorization to Notice Dismissal

Description The 10Web Map Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the gmwdbpinstallnoticestatus function in versions up to, and including, 1.0.73. This makes it possible for authenticated attackers, with subscriber-level...

Easy Social Icons < 3.2.5 - Missing Authorization via cnss_save_ajax_order

Description The Easy Social Icons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the cnsssaveajaxorder function in versions up to, and including, 3.2.4. This makes it possible for authenticated attackers, with subscriber-level access a...

WP EXtra < 6.3 - Missing Authorization to Export Settings

Description The WP EXtra plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the register function in versions up to, and including, 6.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to export plugin...

10WebAnalytics <= 1.2.12 - Missing Authorization via gawd_wd_bp_install_notice_status

Description The 10WebAnalytics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the gawdwdbpinstallnoticestatus function in versions up to, and including, 1.2.12. This makes it possible for authenticated attackers, with subscriber-level...

Funnelforms Free < 3.4.2 - Missing Authorization to Category Deletion

Description The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsfdeletecategory function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permission...

ProductX – Gutenberg WooCommerce Blocks < 3.0.0 - Missing Authorization via option_data_save

Description The ProductX – Gutenberg WooCommerce Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the optiondatasave function in versions up to, and including, 2.7.8. This makes it possible for authenticated attackers, with...

Funnelforms Free < 3.4.2 - Missing Authorization to Arbitrary Post Deletion

Description The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsfdeleteposts function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions a...

CVE-2023-5466

The Wp anything slider plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...