PT-2025-1721 · WordPress · Zox News

Name of the Vulnerable Software and Affected Versions: Zox News theme for WordPress versions up to, and including, 3.16.0 Description: The Zox News theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the...

CVE-2024-13449

The Boom Fest plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'bfadminaction' function in all versions up to, and including, 2.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to updat...

CVE-2024-13449

CVE-2024-13449 affects the Boom Fest WordPress plugin and vues up to version 2.2.1. A missing capability check in bf_admin_action allows authenticated users with Subscriber-level access and above to modify plugin settings that affect site appearance. Remediation per sources (PT-2025-2177) is to u...

CVE-2024-13449 Boom Fest <= 2.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update

The Boom Fest plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'bfadminaction' function in all versions up to, and including, 2.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to updat...

CVE-2024-13368

The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the youzifyofferbanner function in all versions up to, and including, 1.3.2. This makes it possible for...

CVE-2024-13370

The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the saveaddonkeylicense function in all versions up to, and including, 1.3.2. This makes it possible fo...

CVE-2024-13370 Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.3 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update (save_addon_key_license)

The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the saveaddonkeylicense function in all versions up to, and including, 1.3.3. This makes it possible fo...

CVE-2024-13370 Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update (save_addon_key_license)

The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the saveaddonkeylicense function in all versions up to, and including, 1.3.2. This makes it possible fo...

CVE-2024-13368 Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update

The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the youzifyofferbanner function in all versions up to, and including, 1.3.4. This makes it possible for...

CVE-2024-12113

CVE-2024-12113 affects Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress. The issue is an unauthorized data-loss condition caused by a missing capability check on delete_user_review() and delete_review() functions in all versions up to 1.3.2, allowing ...

CVE-2024-13368

The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress (Youzify) suffers a missing capability check in the youzify_offer_banner() function. All versions up to and including 1.3.2 are affected, enabling authenticated attackers with Subscriber-level acces...

CVE-2024-12113 Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress By KaineLabs <= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Review Deletion

The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the deleteuserreview and deletereview functions in all versions up to, and including, 1.3.2. This...

PT-2025-2177 · WordPress · Boom Fest

Name of the Vulnerable Software and Affected Versions: Boom Fest plugin for WordPress versions prior to 2.3 Description: The issue is related to a missing capability check on the bf admin action function, allowing authenticated attackers with Subscriber-level access and above to update plugin...

PT-2025-2136 · WordPress · Youzify

Name of the Vulnerable Software and Affected Versions: Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress versions up to, and including, 1.3.2 Description: The issue is related to unauthorized access due to a missing capability check on the youzify offe...

CVE-2024-11913

The Activity Plus Reloaded for BuddyPress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.1.1 via the 'ajaxpreviewlink' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web...

CVE-2024-11913

CVE-2024-11913 affects the WordPress plugin Activity Plus Reloaded for BuddyPress, with Blind SSRF via ajax_preview_link in all versions up to 1.1.1. Reported by Wordfence; authenticated attackers with Subscriber+ can induce web requests from the app to internal or arbitrary locations, potentiall...

CVE-2024-13335

CVE-2024-13335 affects Spexo Addons for Elementor (WordPress plugin) and is due to a missing capability check in the tmpcoder_theme_install_func() function. The vulnerability exists in all versions up to and including 1.0.14, enabling authenticated attackers with Subscriber-level access and above...

CVE-2024-13236

The Tainacan plugin for WordPress is vulnerable to SQL Injection via the 'collectionid' parameter in all versions up to, and including, 0.21.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2024-13236 Tainacan <= 0.21.12 - Authenticated (Subscriber+) SQL Injection

The Tainacan plugin for WordPress is vulnerable to SQL Injection via the 'collectionid' parameter in all versions up to, and including, 0.21.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2024-13236 Tainacan <= 0.21.12 - Authenticated (Subscriber+) SQL Injection

The Tainacan plugin for WordPress is vulnerable to SQL Injection via the 'collectionid' parameter in all versions up to, and including, 0.21.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...