CVE-2024-7559

The File Manager Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and capability checks in the mkfilefoldermanager AJAX action in all versions up to, and including, 8.3.7. This makes it possible for authenticated attackers, with Subscriber-level...

PT-2024-37760 · WordPress · Imagerecycle

Name of the Vulnerable Software and Affected Versions: ImageRecycle pdf & image compression plugin for WordPress versions up to, and including, 3.1.14 Description: The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing...

CVE-2024-7848

The User Private Files – WordPress File Sharing Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.0 via the 'dpkupvfupdatedoc' due to missing validation on the 'docid' user controlled key. This makes it possible for authenticat...

CVE-2024-7384

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the acymextractArchive function in all versions up to, and including, 9.7.2. This makes it possible fo...

WordPress User Private Files plugin <= 2.1.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private File Access vulnerability

Insecure Direct Object Reference to Authenticated Subscriber+ Private File Access vulnerability discovered by Peter Thaleikis in WordPress Plugin User Private Files versions = 2.1.0...

PT-2024-38626 · WordPress · User Private Files

Name of the Vulnerable Software and Affected Versions: User Private Files – WordPress File Sharing Plugin versions up to, and including, 2.1.0 Description: The issue allows authenticated attackers with subscriber-level access and above to gain access to other users' private files due to missing...

CVE-2024-7030

The Smart Online Order for Clover plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 1.5.6. This makes it possible for authenticated attackers, with Subscriber-level access and above,...

CVE-2024-5941

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access and deletion of data due to a missing capability check on the 'handlerequest' function in all versions up to, and including, 3.14.1. This makes it possible for authenticated attackers,...

PT-2024-38036 · WordPress · Smart Online Order For Clover

Name of the Vulnerable Software and Affected Versions: The Smart Online Order for Clover plugin for WordPress versions up to, and including, 1.5.6 Description: The issue allows authenticated attackers with Subscriber-level access and above to update product and category descriptions, category...

PT-2024-37925 · WordPress · Event Espresso 4 Decaf

Name of the Vulnerable Software and Affected Versions: Event Espresso 4 Decaf – Event Registration Event Ticketing plugin for WordPress versions up to, and including, 5.0.22.decaf Description: The issue is related to a missing capability check on the saveTimezoneString and some other functions,...

PT-2024-37256 · WordPress · Givewp

Name of the Vulnerable Software and Affected Versions: GiveWP – Donation Plugin and Fundraising Platform versions up to, and including, 3.14.1 Description: The issue is related to unauthorized access and deletion of data due to a missing capability check on the handle request function. This allow...

Exploit for CVE-2024-7703

CVE-2024-7703 markdown CVE-2024-7703 Exploit: Stored Cros...

CVE-2024-7703

ARMember – Membership Plugin for WordPress contains a Stored XSS via SVG uploads in all versions up to 4.0.37, exploitable by authenticated users with Subscriber+ privileges; pages loaded from the SVG can execute scripts on access. Red Hat and Wordfence references confirm the issue and note patch...

PT-2024-38523 · Armember · Armember

Name of the Vulnerable Software and Affected Versions: The ARMember – Membership Plugin versions up to, and including, 4.0.37 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows authenticated...

CVE-2024-7624

The Zephyr Project Manager plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 3.3.101. This is due to the plugin not properly checking a users capabilities before allowing them to enable access to the plugin's settings through the...

WordPress Opal Membership plugin <= 1.2.4 - Authenticated (Subscriber+) Information Disclosure vulnerability

Authenticated Subscriber+ Information Disclosure vulnerability discovered by Karolina Jankowska in WordPress Plugin Opal Membership versions = 1.2.4...

PT-2024-38479 · WordPress · Opal Membership

Name of the Vulnerable Software and Affected Versions: Opal Membership plugin for WordPress versions up to and including 1.2.4 Description: The issue allows authenticated attackers with subscriber-level access and above to view private notes that should be restricted to administrators. This is...

CVE-2024-6987

The Orchid Store theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'orchidstoreactivateplugin' function in all versions up to, and including, 1.5.6. This makes it possible for authenticated attackers, with Subscriber-level access and...

CVE-2024-6869

The Falang multilanguage for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 1.3.52. This makes it possible for authenticated attackers, with Subscriber-level access and...

CVE-2024-6869 Falang multilanguage for WordPress <= 1.3.52 - Missing Authorization to Translation Update and Information Exposure

The Falang multilanguage for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 1.3.52. This makes it possible for authenticated attackers, with Subscriber-level access and...