CVE-2025-12014 NGINX Cache Optimizer <= 1.1 - Missing Authorization to Authenticated (Subscriber+) Dynamic Caching Exclusion Update

The NGINX Cache Optimizer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nginxcacheoptimizer-blacklist-update' AJAX action in all versions up to, and including, 1.1. This makes it possible for authenticated attackers, with...

CVE-2025-11257

CVE-2025-11257 — LLM Hubspot Blog Import (WordPress) has a missing authorization check on the process_save_blogs AJAX endpoint in versions up to and including 1.0.1. This allows authenticated attackers with Subscriber-level access and above to trigger an import of all Hubspot data, facilitating u...

CVE-2025-11257 LLM Hubspot Blog Import <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Hubspot Import

The LLM Hubspot Blog Import plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'processsaveblogs' AJAX endpoint in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with Subscriber-level acce...

CVE-2025-11257 LLM Hubspot Blog Import <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Hubspot Import

The LLM Hubspot Blog Import plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'processsaveblogs' AJAX endpoint in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with Subscriber-level acce...

EUVD-2025-35813

The LLM Hubspot Blog Import plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'processsaveblogs' AJAX endpoint in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with Subscriber-level acce...

CVE-2025-11887

Summary (CVE-2025-11887) : The WordPress Supervisor plugin (versions ≤ 1.3.2) is vulnerable to unauthorized modification of data due to a missing capability check across several AJAX endpoints. authenticated attackers with Subscriber-level access or higher can update plugin settings. The vulnerab...

CVE-2025-10740

CVE-2025-10740 affects the WordPress plugin URL Shortener Plugin For WordPress (versions up to 3.0.7). The vulnerability arises from a missing capability check in verifyRequest, allowing authenticated attackers with Subscriber-level access or higher to access API functionality and modify links. T...

CVE-2025-10740 URL Shortener Plugin For WordPress <= 3.0.7 - Missing Authorization to Authenticated (Subscriber+) Link Manipulation

The URL Shortener Plugin For WordPress plugin for WordPress is vulnerable to unauthorized access to functionality provided by the API due to a missing capability check on the verifyRequest function in all versions up to, and including, 3.0.7. This makes it possible for authenticated attackers, wi...

CVE-2025-11887 Supervisor <= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update

The Supervisor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX functions in all versions up to, and including, 1.3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update...

CVE-2025-10740 URL Shortener Plugin For WordPress <= 3.0.7 - Missing Authorization to Authenticated (Subscriber+) Link Manipulation

The URL Shortener Plugin For WordPress plugin for WordPress is vulnerable to unauthorized access to functionality provided by the API due to a missing capability check on the verifyRequest function in all versions up to, and including, 3.0.7. This makes it possible for authenticated attackers, wi...

EUVD-2025-35820

The URL Shortener Plugin For WordPress plugin for WordPress is vulnerable to unauthorized access to functionality provided by the API due to a missing capability check on the verifyRequest function in all versions up to, and including, 3.0.7. This makes it possible for authenticated attackers, wi...

CVE-2025-11887 Supervisor <= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update

The Supervisor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX functions in all versions up to, and including, 1.3.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update...

PT-2025-43586

Name of the Vulnerable Software and Affected Versions URL Shortener Plugin For WordPress versions through 3.0.7 Description The URL Shortener Plugin For WordPress plugin is susceptible to unauthorized access to API functionality. A missing capability check within the verifyRequest function allows...

PT-2025-43590

Name of the Vulnerable Software and Affected Versions Originality.ai AI Checker plugin for WordPress versions through 1.0.12 Description The Originality.ai AI Checker plugin for WordPress is susceptible to unauthorized data loss. This is due to a missing capability check within the ai scan result...

PT-2025-43591

Name of the Vulnerable Software and Affected Versions Check Plagiarism plugin for WordPress versions up to and including 2.0 Description The Check Plagiarism plugin for WordPress has an issue where data can be modified without authorization. This is due to a missing capability check within the ch...

PT-2025-43592

Name of the Vulnerable Software and Affected Versions LLM Hubspot Blog Import plugin for WordPress versions up to and including 1.0.1 Description The LLM Hubspot Blog Import plugin for WordPress is susceptible to unauthorized data modification. This is due to a missing capability check on the...

PT-2025-43594

Name of the Vulnerable Software and Affected Versions WordPress Supervisor Plugin versions up to and including 1.3.2 Description The Supervisor plugin for WordPress is susceptible to unauthorized data modification. This is due to a missing capability check in multiple AJAX functions. Authenticate...

CVE-2025-11128

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.1.0 via the 'feedzysanitizefeeds' function. This makes it possible for authenticated attackers...

CVE-2025-6833

The All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0 via the 'aiotimeclocklitejs' AJAX action due to missing validation on a user controlled key. This makes it...

CVE-2025-10570

The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.38 via the saverefundrequest function. This makes it possible for authenticated attackers, with subscriber-level access and above, to submit...