PT-2024-15272 · WordPress · The Paytium: Mollie Payment Forms & Donations

Name of the Vulnerable Software and Affected Versions: The Paytium: Mollie payment forms & donations plugin for WordPress versions up to, and including, 4.3.7 Description: The issue allows unauthorized modification of data due to a missing capability check on the create mollie account function...

PT-2024-10844 · WordPress · Discount Rules For Woocommerce

Name of the Vulnerable Software and Affected Versions: Discount Rules for WooCommerce plugin for WordPress versions up to, and including, 2.0.2 Description: The issue is related to missing authorization via several AJAX actions due to missing capability checks on various functions. This allows...

PT-2024-15271 · WordPress · The Paytium: Mollie Payment Forms & Donations

Name of the Vulnerable Software and Affected Versions: The Paytium: Mollie payment forms & donations plugin for WordPress versions up to, and including, 4.3.7 Description: The issue is related to unauthorized access of data due to a missing capability check on the check for verified profiles...

WordPress Edwiser Bridge Plugin <= 3.0.7 is vulnerable to Server Side Request Forgery (SSRF)

Software Edwiser Bridge Type Plugin Vulnerable versions = 3.0.7 Fixed in 3.0.8 OWASP Top 10 A10: Server-Side Request Forgery SSRF Classification Server Side Request Forgery SSRF CVE CVE-2024-49312 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID b179ae0d4ea9 Credits Muhamma...

WordPress WP 2FA with Telegram Plugin <= 3.0 is vulnerable to Broken Authentication

Software WP 2FA with Telegram Type Plugin Vulnerable versions = 3.0 Fixed in 3.1 OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2024-9687 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID c6f09889bfbf Credits István...

PT-2024-11043 · WordPress · Essential Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Essential Addons for Elementor plugin for WordPress versions up to and including 4.6.4 Description: The issue is related to authorization bypass due to missing capability checks and nonce disclosure. This allows authenticated attackers wi...

PT-2024-39917 · WordPress · Multiline Files Upload For Contact Form 7

Name of the Vulnerable Software and Affected Versions: Multiline files upload for contact form 7 plugin for WordPress versions up to, and including, 2.8.1 Description: The issue is related to a missing capability check on the mfcf7 zl custom handle deactivation plugin form submission function. Th...

PT-2024-15275 · WordPress · The Paytium: Mollie Payment Forms & Donations

Name of the Vulnerable Software and Affected Versions: The Paytium: Mollie payment forms & donations plugin for WordPress versions up to, and including, 4.3.7 Description: The issue is related to unauthorized data modification due to a missing capability check on the create mollie profile functio...

WordPress Order Attachments for WooCommerce plugin 2.0 - 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary File Upload vulnerability

WordPress Order Attachments for WooCommerce plugin 2.0 - 2.4.1 - Missing Authorization to Authenticated Subscriber+ Limited Arbitrary File Upload vulnerability discovered by luckynoob in WordPress Plugin Order Attachments for WooCommerce versions 2.0 - 2.4.1...

WordPress Read more By Adam plugin <= 1.1.8 - Missing Authorization to Authenticated (Subscriber+) Read More Button Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Read More Button Deletion vulnerability discovered by Francesco Carlucci in WordPress Plugin Read more By Adam versions = 1.1.8...

WordPress Jetpack Plugin < 13.9.1 is vulnerable to Broken Access Control

Software Jetpack Type Plugin Vulnerable versions 13.9.1 Fixed in 13.9.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-9926 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 675e1d99d774 Credits Marc Montpas Required privilege...

WordPress WordPress Gallery Plugin – Limb Image Gallery Plugin <= 1.5.7 is vulnerable to Arbitrary File Download

Software WordPress Gallery Plugin – Limb Image Gallery Type Plugin Vulnerable versions = 1.5.7 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Download CVE CVE-2024-49258 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID f9ffdc125499 Credits...

WordPress Htaccess File Editor Plugin <= 1.0.18 is vulnerable to Broken Access Control

Software Htaccess File Editor Type Plugin Vulnerable versions = 1.0.18 Fixed in 1.0.19 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-49256 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID d6dd94150ebc Credits savphill Require...

WordPress CSV Product Import Export for WooCommerce Plugin <= 1.0.0 is vulnerable to SQL Injection

Software CSV Product Import Export for WooCommerce Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-49244 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 62295a347894 Credits Hakiduck Required...

WordPress ProfileGrid Plugin <= 5.9.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software ProfileGrid Type Plugin Vulnerable versions = 5.9.3 Fixed in 5.9.3.1 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-49273 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 8da39e4aabe3 Credits Trương Hữu Phúc...

WordPress Free Stock Photos Foter Plugin <= 1.5.4 is vulnerable to PHP Object Injection

Software Free Stock Photos Foter Type Plugin Vulnerable versions = 1.5.4 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2024-49227 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 0e6ee5afeccb Credits LVT-tholv2k Required privilege...

WordPress Read more By Adam Plugin <= 1.1.8 is vulnerable to Broken Access Control

Software Read more By Adam Type Plugin Vulnerable versions = 1.1.8 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-9187 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID bad5d062abf4 Credits Francesco Carlucci Required...

CVE-2024-9756

The Order Attachments for WooCommerce plugin for WordPress is vulnerable to unauthorized limited arbitrary file uploads due to a missing capability check on the wcoaaddattachment AJAX action in versions 2.0 to 2.4.1. This makes it possible for authenticated attackers, with subscriber-level access...

CVE-2024-9824

The ImagePress – Image Gallery plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'ipdeletepost' and 'ipupdateposttitle' functions in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers...

CVE-2024-9824 ImagePress - Image Gallery <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Post Title Update

The ImagePress – Image Gallery plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'ipdeletepost' and 'ipupdateposttitle' functions in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers...