CVE-2024-10311 External Database Based Actions <= 0.1 - Authenticated (Subscriber+) Authentication Bypass

The External Database Based Actions plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 0.1. This is due to a missing capability check in the 'edbaadminhandle' function. This makes it possible for authenticated attackers, with subscriber-level permissions...

CVE-2024-10582

The Music Player for Elementor – Audio Player & Podcast Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the importmpfetemplate function in all versions up to, and including, 2.4.1. This makes it possible for authenticated...

CVE-2024-10897

The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the installetlmsdependencyplugin function in all versions up to, and including, 2.1.5. This makes it possible for authenticated attackers, with Subscriber-lev...

CVE-2024-10897

The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the installetlmsdependencyplugin function in all versions up to, and including, 2.1.5. This makes it possible for authenticated attackers, with Subscriber-lev...

CVE-2024-10897 Tutor LMS Elementor Addons <= 2.1.5 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation

The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the installetlmsdependencyplugin function in all versions up to, and including, 2.1.5. This makes it possible for authenticated attackers, with Subscriber-lev...

PT-2024-16747 · WordPress · Wp Log Viewer

Name of the Vulnerable Software and Affected Versions: WP Log Viewer plugin for WordPress versions up to, and including, 1.2.1 Description: The issue is related to unauthorized use of functionality due to a missing capability check on several AJAX actions. This allows authenticated attackers with...

WordPress External Database Based Actions Plugin <= 0.1 is vulnerable to Privilege Escalation

Software External Database Based Actions Type Plugin Vulnerable versions = 0.1 Fixed in N/A OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-10311 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID cd4901766574...

PT-2024-39479 · WordPress · Wordpress Video Robot

Name of the Vulnerable Software and Affected Versions: WordPress Video Robot - The Ultimate Video Importer plugin for WordPress versions up to and including 1.20.0 Description: The issue is related to insufficient validation of user metadata that can be updated in the wpvr rate request result...

WordPress WP Quick Setup Plugin <= 2.0 is vulnerable to Arbitrary File Upload

Software WP Quick Setup Type Plugin Vulnerable versions = 2.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-52429 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID ceb3ca8b7fc9 Credits Mika Required privilege Subscriber Published...

PT-2024-16143 · WordPress · Drop Shadow Boxes

Name of the Vulnerable Software and Affected Versions: Drop Shadow Boxes plugin for WordPress versions up to, and including, 1.7.14 Description: The issue is related to arbitrary shortcode execution due to the software allowing users to execute an action that does not properly validate a value...

PT-2024-16545 · WordPress · Simple Local Avatars

Name of the Vulnerable Software and Affected Versions: The Simple Local Avatars plugin for WordPress versions up to, and including, 2.7.11 Description: The issue is related to a missing capability check on the sla clear user cache function, allowing authenticated attackers with Subscriber-level...

WordPress Simple Local Avatars Plugin <= 2.7.11 is vulnerable to Broken Access Control

Software Simple Local Avatars Type Plugin Vulnerable versions = 2.7.11 Fixed in 2.8.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-10786 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 717b24faeea4 Credits Trương Hữu Phúc...

PT-2024-16381 · WordPress · The Music Player For Elementor – Audio Player & Podcast Player

Name of the Vulnerable Software and Affected Versions: The Music Player for Elementor – Audio Player & Podcast Player plugin for WordPress versions up to, and including, 2.4.1 Description: The issue is related to unauthorized modification of data due to a missing capability check on the import mp...

WordPress Music Player for Elementor plugin <= 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Template Import vulnerability

Missing Authorization to Authenticated Subscriber+ Template Import vulnerability discovered by WordFence in WordPress Plugin Music Player for Elementor – Audio Player & Podcast Player versions = 2.4.1...

PT-2024-9554 · Stripe · Stripe

Name of the Vulnerable Software and Affected Versions: WPForms versions 1.8.4 through 1.9.2.1 Description: The issue is related to a missing capability check in the wpforms is admin page function, which allows authenticated attackers with Subscriber-level access and above to refund payments and...

PT-2024-16629 · WordPress · Tutor Lms Elementor Addons

Name of the Vulnerable Software and Affected Versions: Tutor LMS Elementor Addons plugin for WordPress versions up to, and including, 2.1.5 Description: The issue is related to a missing capability check on the install etlms dependency plugin function, allowing authenticated attackers with...

WordPress User Extra Fields plugin <= 16.6 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation vulnerability

Missing Authorization to Authenticated Subscriber+ Privilege Escalation vulnerability discovered by Tonn in WordPress Plugin User Extra Fields versions = 16.6...

WordPress Kognetiks Chatbot for WordPress plugin <= 2.1.8 - Cross-Site Request Forgery to Authenticated (Subscriber+) Assistant Modification vulnerability

Cross-Site Request Forgery to Authenticated Subscriber+ Assistant Modification vulnerability discovered by Tieu Pham Trong Nhan in WordPress Plugin Kognetiks Chatbot for WordPress versions = 2.1.8...

WordPress Kognetiks Chatbot for WordPress plugin <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant Addition vulnerability

Missing Authorization to Authenticated Subscriber+ Assistant Addition vulnerability discovered by Tieu Pham Trong Nhan in WordPress Plugin Kognetiks Chatbot for WordPress versions = 2.1.7...

WordPress Kognetiks Chatbot for WordPress plugin <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Assistant Deletion vulnerability discovered by Tieu Pham Trong Nhan in WordPress Plugin Kognetiks Chatbot for WordPress versions = 2.1.7...