CVE-2024-8428

The ForumWP – Forum & Discussion Board Plugin plugin for WordPress is vulnerable to Privilege Escalation via Insecure Direct Object Reference in all versions up to, and including, 2.0.2 via the submitformhandler due to missing validation on the 'userid' user controlled key. This makes it possible...

CVE-2024-8427

The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveglobalsettings and processformedit functions in all versions up to, and including, 1.2.2. This makes i...

PT-2024-39005 · WordPress · Forumwp

Name of the Vulnerable Software and Affected Versions: The ForumWP – Forum & Discussion Board Plugin plugin for WordPress versions up to, and including, 2.0.2 Description: The issue is related to Privilege Escalation via Insecure Direct Object Reference. This is due to missing validation on the...

PT-2024-39004 · WordPress · Frontend Post Submission Manager Lite – Frontend Posting Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin versions up to, and including, 1.2.2 Description: The issue allows authenticated attackers with Subscriber-level access and above to update the plugin's settings an...

CVE-2024-5309

The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the fvexportcsv, resetsettings, savesettings, savecolumnssettings, getanalyticsdata, geteventlogsdata, deletesubmissions, and...

PT-2024-38310 · WordPress · Geo Controller

Name of the Vulnerable Software and Affected Versions: Geo Controller plugin for WordPress versions up to, and including, 8.6.9 Description: The issue arises from missing capability checks on the ajax geolocate menu and ajax geolocate remove menu functions, allowing authenticated attackers with...

CVE-2024-8106

The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.8 via the downloaduserajax function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extra...

CVE-2024-8104

The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.0.8 via the downloadfileajax function. This makes it possible for authenticated attackers, with subscriber access and above, to read the contents of...

CVE-2024-8102

The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the modulealltoggleajax function in all versions up to, and including, 3.0.8. This makes it possible...

CVE-2024-8104 The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Directory Traversal to Authenticated (Subscriber+) Arbitrary File Download

The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.0.8 via the downloadfileajax function. This makes it possible for authenticated attackers, with subscriber access and above, to read the contents of...

PT-2024-38802 · WordPress · Wp Extended

Name of the Vulnerable Software and Affected Versions: The Ultimate WordPress Toolkit – WP Extended plugin for WordPress versions up to, and including, 3.0.8 Description: The issue is related to unauthorized modification of data that can lead to privilege escalation due to a missing capability...

CVE-2024-5053

The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized Malichimp API key update due to an insufficient capability check on the verifyRequest function in all versions up to, and including, 5.1.18. This makes it...

PT-2024-38532 · WordPress · Events Manager

Name of the Vulnerable Software and Affected Versions: WP Events Manager plugin for WordPress versions up to, and including, 2.1.11 Description: The WP Events Manager plugin for WordPress is vulnerable to time-based SQL Injection via the order parameter due to insufficient escaping on the...

CVE-2024-5784

The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized administrative actions execution due to a missing capability checks on multiple functions like treportquizatttemptdelete and tutorgcclassaction in all versions up to, and including, 2.7.2. This makes it possible for authenticate...

CVE-2024-5784 Tutor LMS Pro <= 2.7.2 - Missing Authorization to Authenticated (Subscriber+) Insecure Direct Object Reference

The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized administrative actions execution due to a missing capability checks on multiple functions like treportquizatttemptdelete and tutorgcclassaction in all versions up to, and including, 2.7.2. This makes it possible for authenticate...

PT-2024-38635 · WordPress · Media Library Folders

Name of the Vulnerable Software and Affected Versions: Media Library Folders plugin for WordPress versions up to, and including, 8.2.3 Description: The issue is related to missing capability checks on several AJAX functions in the media-library-plus.php file. This allows authenticated attackers...

CVE-2024-7856

The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the removeTempFiles function and insufficient path validation on the 'file' parameter in all versions up to, and...

PT-2024-38633 · Sonaar · Mp3 Audio Player – Music Player

Name of the Vulnerable Software and Affected Versions: The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress versions up to, and including, 5.7.0.1 Description: The issue is related to unauthorized arbitrary file deletion due to a missing capability check on t...

PT-2024-38870 · WordPress · Reviews Feed – Add Testimonials/Customer Reviews From Google Reviews

Name of the Vulnerable Software and Affected Versions: Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More plugin for WordPress versions 1.1.2 and earlier Description: The issue is related to a missing capability check on the update api key...

PT-2024-37800 · WordPress · Oxygen Builder

Name of the Vulnerable Software and Affected Versions: Oxygen Builder plugin for WordPress versions up to, and including, 4.8.3 Description: The issue is related to a missing capability check on the oxy save css from admin AJAX action. This makes it possible for authenticated attackers, with...