PT-2025-9813

Name of the Vulnerable Software and Affected Versions The Zass - WooCommerce Theme for Handmade Artists and Artisans versions up to, and including, 3.9.9.10 Description The issue allows authenticated attackers with Subscriber-level access and above to import demo content and overwrite the site du...

PT-2025-9812

Name of the Vulnerable Software and Affected Versions The Hero Slider - WordPress Slider Plugin versions up to, and including, 1.3.5 Description The issue allows authenticated attackers with Subscriber-level access and above to perform SQL Injection attacks due to insufficient escaping on the use...

CVE-2024-13747: Missing Authorization

The WooMail - WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'templatedeletesaved' function in all versions up to, and including, 3.0.34. This makes it possible for authenticated attackers, with Subscriber-leve...

CVE-2024-13778: Improper Neutralization of Special Elements used in an SQL Command

The Hero Mega Menu - Responsive WordPress Menu Plugin plugin for WordPress is vulnerable to SQL Injection via several functions in all versions up to, and including, 1.16.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

PT-2025-9805

Name of the Vulnerable Software and Affected Versions The WooMail - WooCommerce Email Customizer plugin for WordPress versions up to, and including, 3.0.34 Description The issue is related to a missing capability check on the template delete saved function, allowing authenticated attackers with...

CVE-2024-13811: Missing Authorization

The Lafka - Multi Store Burger - Pizza & Food Delivery WooCommerce Theme theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'lafkaimportlafka' AJAX actions in all versions up to, and including, 4.5.7. This makes it possible for authenticated attacker...

PT-2025-9808

Name of the Vulnerable Software and Affected Versions The Hero Mega Menu - Responsive WordPress Menu Plugin versions up to, and including, 1.16.5 Description The issue arises from insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query,...

PT-2025-9804

Name of the Vulnerable Software and Affected Versions WordPress Awesome Import & Export Plugin - Import & Export WordPress Data plugin versions up to, and including, 4.1.1 Description The issue is related to arbitrary SQL execution and privilege escalation due to a missing capability check on the...

CVE-2024-13787: Deserialization of Untrusted Data

The VEDA - MultiPurpose WordPress Theme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.2 via deserialization of untrusted input in the 'vedabackupandrestoreaction' function. This makes it possible for authenticated attackers, with Subscriber-leve...

CVE-2024-13809: Improper Neutralization of Special Elements used in an SQL Command

The Hero Slider - WordPress Slider Plugin plugin for WordPress is vulnerable to SQL Injection via several parameters in all versions up to, and including, 1.3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2025-1307

The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the newscrunchinstallandactivateplugin function in all versions up to, and including, 1.8.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above...

CVE-2025-1639

The Animation Addons for Elementor Pro plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the installelementorpluginhandler function in all versions up to, and including, 1.6. This makes it possible for authenticated attackers, wi...

CVE-2024-13686

The VW Storefront theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vwstorefrontresetallsettings function in all versions up to, and including, 0.9.9. This makes it possible for authenticated attackers, with Subscriber-level access and...

CVE-2024-13686: Missing Authorization

The VW Storefront theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vwstorefrontresetallsettings function in all versions up to, and including, 0.9.9. This makes it possible for authenticated attackers, with Subscriber-level access and...

CVE-2025-1307: Missing Authorization

The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the newscrunchinstallandactivateplugin function in all versions up to, and including, 1.8.4.1. This makes it possible for authenticated attackers, with Subscriber-level access and above...

PT-2025-9622

Name of the Vulnerable Software and Affected Versions Newscrunch theme for WordPress versions up to, and including, 1.8.4.1 Description The issue is related to a missing capability check in the newscrunch install and activate plugin function, allowing authenticated attackers with Subscriber-level...

CVE-2025-1639: Missing Authorization

The Animation Addons for Elementor Pro plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the installelementorpluginhandler function in all versions up to, and including, 1.6. This makes it possible for authenticated attackers, wi...

CVE-2024-13358

The BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wc4bpdeletepage function in all versions up to, and including, 3.4.24. This makes it possible for authenticated...

CVE-2025-1723: Improper Authentication

Zohocorp ManageEngine ADSelfService Plus versions 6510 and below are vulnerable to account takeover due to the session mishandling. Valid account holders in the setup only have the potential to exploit this bug...

CVE-2024-13402

The Buddyboss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘linktitle’ parameter in all versions up to, and including, 2.7.70 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level...