WordPress Clariti Plugin <= 1.2.1 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Nabil Irawan in WordPress Plugin Clariti versions = 1.2.1...

WordPress DethemeKit For Elementor Plugin <= 2.1.10 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Que Thanh Tuan - Blue Rock in WordPress Plugin DethemeKit For Elementor versions = 2.1.10...

WordPress Trustpilot Reviews Plugin <= 2.5.925 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Que Thanh Tuan - Blue Rock in WordPress Plugin Trustpilot Reviews versions = 2.5.925...

WordPress Social Pug Plugin <= 1.35.2 - Sensitive Data Exposure Vulnerability

Sensitive Data Exposure Vulnerability discovered by Que Thanh Tuan - Blue Rock in WordPress Plugin Hubbub Lite versions = 1.35.2...

WordPress PilotPress Plugin <= 2.0.36 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Nabil Irawan in WordPress Plugin PilotPress versions = 2.0.36...

WordPress Oshine Core Plugin <= 1.5.5 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin Oshine Core versions = 1.5.5...

WordPress Text To Speech TTS Accessibility plugin <= 1.9.30 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Denver Jackson in WordPress Plugin Text To Speech TTS Accessibility versions = 1.9.30...

WordPress ListingPro Reviews plugin < 2.9.11 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin ListingPro Reviews versions 2.9.11...

WordPress WP User Frontend Plugin <= 4.1.12 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Kishan Vyas in WordPress Plugin WP User Frontend versions = 4.1.12...

WordPress Payrexx Payment Gateway for WooCommerce Plugin <= 3.1.5 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Legion Hunter in WordPress Plugin Payrexx Payment Gateway for WooCommerce versions = 3.1.5...

WordPress MasterStudy LMS Plugin <= 3.6.20 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Bibek Dhakal in WordPress Plugin MasterStudy LMS versions = 3.6.20...

WordPress wpDiscuz Plugin <= 7.6.33 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Legion Hunter in WordPress Plugin wpDiscuz versions = 7.6.33...

CVE-2025-10305

The Secure Passkeys plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the deletepasskey and passkeyslist function in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, t...

WordPress WPLMS Theme <= 4.970 is vulnerable to Broken Access Control

Software WPLMS Type Theme Vulnerable versions = 4.970 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2025-58668 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID b45c9c5a0459 Credits Rafie Muhammad Patchstack Required privile...

CVE-2025-10305

The Secure Passkeys plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the deletepasskey and passkeyslist function in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, t...

CVE-2025-10305 Secure Passkeys <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Passkey Exposure and Deletion

The Secure Passkeys plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the deletepasskey and passkeyslist function in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, t...

CVE-2025-10305 Secure Passkeys <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Passkey Exposure and Deletion

The Secure Passkeys plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the deletepasskey and passkeyslist function in all versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, t...

CVE-2025-10305

CVE-2025-10305 documents a vulnerability in the WordPress Secure Passkeys plugin (versions up to and including 1.2.1) where delete_passkey() and passkeys_list() lack proper authorization checks. This allows authenticated users with Subscriber+ privileges to view and delete passkeys. The issue has...

WordPress Secure Passkeys plugin <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Passkey Exposure and Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Passkey Exposure and Deletion vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Secure Passkeys versions = 1.2.1...

PT-2025-38630

Name of the Vulnerable Software and Affected Versions Secure Passkeys plugin for WordPress versions up to and including 1.2.1 Description The Secure Passkeys plugin for WordPress is susceptible to unauthorized access due to a missing capability check within the delete passkey and passkeys list...