CVE-2024-11724

CVE-2024-11724 concerns the WordPress plugin Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (GDPR/CCPA/ePrivacy). The issue is described as a missing capability check on the wpl_script_save AJAX action in all versions up to and including 3.6.5, enabling authen...

CVE-2024-12172

The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpcupdateusermetaoption function in all versions up to, and including, 3.2.21. This makes it...

CVE-2024-12018

The Snippet Shortcodes plugin for WordPress is vulnerable to unauthorized Shortcode Deletion due to missing authorization in all versions up to, and including, 4.1.6. Note that a nonce is used as authentication here, but the value is leaked. This makes it possible for authenticated attackers, wit...

CVE-2024-12263 Child Theme Creator by Orbisius <= 1.5.5 - Missing Authorization to Authenticated (Subscriber+) Cloud Snippet Update/Delete

The Child Theme Creator by Orbisius plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clouddelete and cloudupdate functions in all versions up to, and including, 1.5.5. This makes it possible for authenticated attackers, with...

EUVD-2024-50647

The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpcupdateusermetaoption function in all versions up to, and including, 3.2.21. This makes it...

CVE-2024-12018 Snippet Shortcodes <= 4.1.6 - Authenticated (Subscriber+) Shortcode Deletion

The Snippet Shortcodes plugin for WordPress is vulnerable to unauthorized Shortcode Deletion due to missing authorization in all versions up to, and including, 4.1.6. Note that a nonce is used as authentication here, but the value is leaked. This makes it possible for authenticated attackers, wit...

CVE-2024-12341

The Custom Skins Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'cf7csactioncallback' function in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with Subscriber-level acce...

CVE-2024-11443

The de:branding plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the debrandingsave function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with...

CVE-2024-11443

The CVE-2024-11443 issue affects the de:branding WordPress plugin. Description: missing capability check in debranding_save() across versions up to 1.0.2 allows authenticated users with Subscriber+ privileges to modify options, potentially changing the default registration role to administrator a...

CVE-2024-12341 Custom Skins Contact Form 7 <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Update and Skin Creation

The Custom Skins Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'cf7csactioncallback' function in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with Subscriber-level acce...

PT-2024-16388 · Nginx · Nginx

Name of the Vulnerable Software and Affected Versions: Opt-In Downloads plugin for WordPress versions up to, and including, 4.07 Description: The issue is related to missing file type validation in the admin upload function, allowing authenticated attackers with Subscriber-level access and above ...

PT-2024-17403 · WordPress · Snippet Shortcodes

Name of the Vulnerable Software and Affected Versions: Snippet Shortcodes plugin for WordPress versions up to and including 4.1.6 Description: The issue is related to missing authorization, allowing authenticated attackers with Subscriber-level access and above to delete the plugin's shortcodes. ...

PT-2024-17517 · Orbisius · Orbisius-Child-Theme-Creator

Name of the Vulnerable Software and Affected Versions: Child Theme Creator by Orbisius plugin for WordPress versions up to, and including, 1.5.5 Description: The issue is related to unauthorized modification of data due to a missing capability check on the cloud delete and cloud update functions...

PT-2024-17469 · WordPress · Wp Courses Lms

Name of the Vulnerable Software and Affected Versions: WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress versions up to, and including, 3.2.21 Description: The issue is related to unauthorized access due to a missing capability...

CVE-2024-11840

CVE-2024-11840 affects RapidLoad AI – Optimize Web Vitals Automatically (WordPress plugin) up to v2.4.2. It lacks capability checks on multiple functions (uucss_data, update_rapidload_settings, wp_ajax_update_htaccess_file, uucss_update_rule, upload_rules, get_all_rules, update_titan_settings, pr...

CVE-2024-11205

The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpformsisadminpage' function in versions starting from 1.8.4 up to, and including, 1.9.2.1. This makes it possible for authenticated attackers, with Subscriber-level acces...

CVE-2024-11205 WPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation

The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpformsisadminpage' function in versions starting from 1.8.4 up to, and including, 1.9.2.1. This makes it possible for authenticated attackers, with Subscriber-level acces...

CVE-2024-11205 WPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation

The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpformsisadminpage' function in versions starting from 1.8.4 up to, and including, 1.9.2.1. This makes it possible for authenticated attackers, with Subscriber-level acces...

CVE-2024-12253 Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal <= 3.1.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update / Data Access

The Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'savesettings', 'exportcsv', and 'simpleecommcart-action' actions in all versions up to, and including, 3.1.2. This makes it...

CVE-2024-12026

The Message Filter for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveFilter function in all versions up to, and including, 1.6.3. This makes it possible for authenticated attackers, with Subscriber-level access...