CVE-2024-13541

CVE-2024-13541 concerns the WordPress plugin “aDirectory – WordPress Directory Listing Plugin” (versions up to 2.3). The issue is a missing capability/auth check in the adqs_delete_listing() function, enabling authenticated users with Subscriber-level access and above to delete arbitrary posts. P...

CVE-2024-13541 aDirectory – WordPress Directory Listing Plugin <= 2.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion

The aDirectory – WordPress Directory Listing Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the adqsdeletelisting function in all versions up to, and including, 2.3. This makes it possible for authenticated attackers, with...

CVE-2024-13541 aDirectory – WordPress Directory Listing Plugin <= 2.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion

The aDirectory – WordPress Directory Listing Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the adqsdeletelisting function in all versions up to, and including, 2.3. This makes it possible for authenticated attackers, with...

PT-2025-6457 · WordPress +1 · Wordpress +1

Name of the Vulnerable Software and Affected Versions: Apus Framework plugin for WordPress versions prior to 2.3 Description: The issue allows authenticated attackers with Subscriber-level access and above to update arbitrary options on the WordPress site due to a missing capability check on the...

PT-2025-6441 · WordPress · The Puzzles | Wp Magazine / Review With Store Wordpress Theme + Rtl

Name of the Vulnerable Software and Affected Versions: The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress versions up to, and including, 4.2.4 Description: The issue is related to a missing capability check on the theme options ajax post action AJAX action,...

PT-2025-6454 · WordPress · The Global Gallery

Name of the Vulnerable Software and Affected Versions: The Global Gallery - WordPress Responsive Gallery plugin for WordPress versions up to, and including, 9.1.5 Description: The issue arises from the software allowing users to execute an action that does not properly validate a value before...

PT-2025-6436 · Zoxpress +1 · Zoxpress +1

Name of the Vulnerable Software and Affected Versions: The ZoxPress - The All-In-One WordPress News Theme versions up to, and including, 2.12.0 Description: The issue allows unauthorized modification of data, leading to privilege escalation due to a missing capability check on the backup options...

PT-2025-6443 · WordPress · Wp Table Manager

Name of the Vulnerable Software and Affected Versions: WP Table Manager plugin for WordPress versions up to, and including, 4.1.3 Description: The issue is related to a missing capability check on the thewptm getFolders AJAX action, allowing authenticated attackers with Subscriber-level access an...

PT-2025-6434 · WordPress · Wpsyncsheets Lite For Wpforms

Name of the Vulnerable Software and Affected Versions: WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon plugin for WordPress versions up to, and including, 1.6 Description: The issue is related to unauthorized modification of data due to a missing capability check on the wpsslwp...

WordPress ConvertPlus plugin <= 3.5.30 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update vulnerability

Missing Authorization to Authenticated Subscriber+ Limited Options Update vulnerability discovered by Lucio Sá in WordPress Plugin ConvertPlus versions = 3.5.30...

WordPress ZoxPress theme <= 2.12.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Options Update vulnerability discovered by Lucio Sá in WordPress Theme ZoxPress versions = 2.12.0...

CVE-2024-13506 GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.97 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display_name Parameter

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the displayname profile parameter in all versions up to, and including, 2.8.97 due to insufficient input sanitization and output escaping. This...

CVE-2024-13643 Zox News <= 3.17.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Modification

The Zox News - Professional WordPress News & Magazine Theme plugin for WordPress is vulnerable to unauthorized data modification. This vulnerability can lead to privilege escalation and denial of service conditions due to missing capability checks on the backupoptions and resetoptions functions i...

CVE-2024-13643

CVE-2024-13643 relates to the Zox News – Pro WordPress Theme plugin (WordPress) with versions up to 3.17.0. The root cause, per Wordfence and related sources, is missing authorization checks in backup_options() and reset_options(), allowing authenticated users with Subscriber-level access and abo...

PT-2025-6192 · WordPress · Geodirectory – Wp Business Directory Plugin

Name of the Vulnerable Software and Affected Versions: The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress versions up to, and including, 2.8.97 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitizati...

PT-2025-6170 · WordPress · Zox News - Professional Wordpress News & Magazine Theme

Name of the Vulnerable Software and Affected Versions: Zox News - Professional WordPress News & Magazine Theme plugin for WordPress versions up to and including 3.17.0 Description: The vulnerability can lead to privilege escalation and denial of service conditions due to missing capability checks...

CVE-2024-11134

The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'eventerexportbookingscsv' function in all versions up to, and including, 3.9.9. This makes it possible for authenticated attackers with subscriber-level permissions or above, to...

CVE-2022-47410

An issue was discovered in the fpnewsletter aka Newsletter subscriber management extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6 for TYPO3. Data about subscribers may be obtained via createAction operations...

CVE-2022-1463

The Booking Calendar plugin for WordPress is vulnerable to PHP Object Injection via the bookingflextimeline shortcode in versions up to, and including, 9.1. This could be exploited by subscriber-level users and above to call arbitrary PHP objects on a vulnerable site...

CVE-2020-36730

The CMP for WordPress is vulnerable to authorization bypass due to a missing capability check on the cmpgetpostdetail, niteoexportcsv, and cmpdisablecomingsoonajax functions in versions up to, and including, 3.8.1. This makes it possible for unauthenticated attackers to read posts, export...