CVE-2024-8427

The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveglobalsettings and processformedit functions in all versions up to, and including, 1.2.2. This makes i...

CVE-2024-8427 Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update

The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveglobalsettings and processformedit functions in all versions up to, and including, 1.2.2. This makes i...

CVE-2024-8427

CVE-2024-8427 affects the WordPress plugin Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin (

WordPress ForumWP plugin <= 2.0.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via Account Takeover vulnerability

Insecure Direct Object Reference to Authenticated Subscriber+ Privilege Escalation via Account Takeover vulnerability discovered by wesley wcraft in WordPress Plugin ForumWP versions = 2.0.2...

WordPress Revision Manager TMC plugin <= 2.8.19 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Email Sending vulnerability discovered by Lucio Sá in WordPress Plugin Revision Manager TMC versions = 2.8.19...

WordPress Frontend Post Submission Manager Lite plugin <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update vulnerability

Missing Authorization to Authenticated Subscriber+ Settings Update vulnerability discovered by Lucio Sá in WordPress Plugin Frontend Post Submission Manager Lite versions = 1.2.2...

PT-2024-39005 · WordPress · Forumwp

Name of the Vulnerable Software and Affected Versions: The ForumWP – Forum & Discussion Board Plugin plugin for WordPress versions up to, and including, 2.0.2 Description: The issue is related to Privilege Escalation via Insecure Direct Object Reference. This is due to missing validation on the...

WordPress Frontend Post Submission Manager Lite Plugin <= 1.2.2 is vulnerable to Broken Access Control

Software Frontend Post Submission Manager Lite Type Plugin Vulnerable versions = 1.2.2 Fixed in 1.2.3 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-8427 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID ea5d9d3b8976 Credits Lucio Sá...

WordPress ForumWP Plugin <= 2.0.2 is vulnerable to Privilege Escalation

Software ForumWP Type Plugin Vulnerable versions = 2.0.2 Fixed in 2.1.0 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-8428 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 04472abbfa0c Credits wesley wcraft...

WordPress Newsletters Plugin <= 4.9.9.2 is vulnerable to Privilege Escalation

Software Newsletters Type Plugin Vulnerable versions = 4.9.9.2 Fixed in 4.9.9.3 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-8247 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID eb3ac75f37d4 Credits rajesh...

PT-2024-39004 · WordPress · Frontend Post Submission Manager Lite – Frontend Posting Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin versions up to, and including, 1.2.2 Description: The issue allows authenticated attackers with Subscriber-level access and above to update the plugin's settings an...

CVE-2024-7380 Geo Controller <= 8.7.3 - Missing Authorization to Authenticated (Subscriber+) Menu Creation/Deletion

The Geo Controller plugin for WordPress is vulnerable to unauthorized menu creation/deletion due to missing capability checks on the ajaxgeolocatemenu and ajaxgeolocateremovemenu functions in all versions up to, and including, 8.7.3. This makes it possible for authenticated attackers, with...

CVE-2024-7380

CVE-2024-7380 — Geo Controller (WordPress) security issue : The Geo Controller plugin (WordPress) up to and including version 8.6.9 is vulnerable to unauthorized menu creation/deletion due to missing capability checks in ajax__geolocate_menu and ajax__geolocate_remove_menu. Affected product: Geo ...

CVE-2024-7380 Geo Controller <= 8.7.3 - Missing Authorization to Authenticated (Subscriber+) Menu Creation/Deletion

The Geo Controller plugin for WordPress is vulnerable to unauthorized menu creation/deletion due to missing capability checks on the ajaxgeolocatemenu and ajaxgeolocateremovemenu functions in all versions up to, and including, 8.7.3. This makes it possible for authenticated attackers, with...

CVE-2024-5309

The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the fvexportcsv, resetsettings, savesettings, savecolumnssettings, getanalyticsdata, geteventlogsdata, deletesubmissions, and...

CVE-2024-5309

The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the fvexportcsv, resetsettings, savesettings, savecolumnssettings, getanalyticsdata, geteventlogsdata, deletesubmissions, and...

PT-2024-38310 · WordPress · Geo Controller

Name of the Vulnerable Software and Affected Versions: Geo Controller plugin for WordPress versions up to, and including, 8.6.9 Description: The issue arises from missing capability checks on the ajax geolocate menu and ajax geolocate remove menu functions, allowing authenticated attackers with...

LatePoint <= 4.9.91 - Authenticated (Subscriber+) Stored Cross-Site Scripting

Description The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.9.91 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject...

CVE-2024-8106

The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.8 via the downloaduserajax function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extra...

CVE-2024-8104

The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.0.8 via the downloadfileajax function. This makes it possible for authenticated attackers, with subscriber access and above, to read the contents of...