10064 matches found
CVE-2024-6012 Cost Calculator Builder <= 3.2.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Creation
The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'embed-create-page' and 'embed-insert-pages' functions in all versions up to, and including, 3.2.12. This makes it possible for authenticated attackers, wit...
WordPress Cost Calculator Builder plugin <= 3.2.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Creation vulnerability
Missing Authorization to Authenticated Subscriber+ Arbitrary Content Creation vulnerability discovered by Lucio Sá in WordPress Plugin Cost Calculator Builder versions = 3.2.12...
WordPress Cost Calculator Builder Plugin <= 3.2.12 is vulnerable to Broken Access Control
Software Cost Calculator Builder Type Plugin Vulnerable versions = 3.2.12 Fixed in 3.2.13 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-6012 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 94eafd7e3cb2 Credits Lucio Sá Required...
WordPress Simple Photoswipe plugin <= 0.1 - Subscriber+ Arbitrary Settings Update vulnerability
Subscriber+ Arbitrary Settings Update vulnerability discovered by Felipe Caon in WordPress Plugin Simple Photoswipe versions = 0.1...
WordPress Simple Photoswipe Plugin <= 0.1 is vulnerable to Settings Change
Software Simple Photoswipe Type Plugin Vulnerable versions = 0.1 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2024-5570 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 461ac97ab0b1 Credits Felipe Caon Required privilege...
WordPress Uncanny Toolkit Pro for LearnDash plugin < 4.1.4.1 - Subscriber+ Arbitrary Post/Page Duplication vulnerability
Subscriber+ Arbitrary Post/Page Duplication vulnerability discovered by Dave Jong Patchstack in WordPress Plugin Uncanny Toolkit Pro for LearnDash versions 4.1.4.1...
WordPress Easy Affiliate Links plugin <= 3.7.3 - Missing Authorization to Authenticated (Subscriber+) Settings Reset vulnerability
Missing Authorization to Authenticated Subscriber+ Settings Reset vulnerability discovered by Lucio Sá in WordPress Plugin Easy Affiliate Links versions = 3.7.3...
CVE-2024-5570
CVE-2024-5570 affects the Simple Photoswipe WordPress plugin (version
CVE-2024-5864
The Easy Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the eaflresetsettings AJAX action in all versions up to, and including, 3.7.3. This makes it possible for authenticated attackers, with Subscriber-level access and...
CVE-2024-5864 Easy Affiliate Links <= 3.7.3 - Missing Authorization to Authenticated (Subscriber+) Settings Reset
The Easy Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the eaflresetsettings AJAX action in all versions up to, and including, 3.7.3. This makes it possible for authenticated attackers, with Subscriber-level access and...
CVE-2024-5864 Easy Affiliate Links <= 3.7.3 - Missing Authorization to Authenticated (Subscriber+) Settings Reset
The Easy Affiliate Links plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the eaflresetsettings AJAX action in all versions up to, and including, 3.7.3. This makes it possible for authenticated attackers, with Subscriber-level access and...
WordPress Zita Elementor Site Library Plugin <= 1.6.1 is vulnerable to Arbitrary Code Execution
Software Zita Elementor Site Library Type Plugin Vulnerable versions = 1.6.1 Fixed in 1.6.2 OWASP Top 10 A1: Broken Access Control Classification Arbitrary Code Execution CVE CVE-2024-37420 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID a25d18d1f0cd Credits Majed Refaea...
WordPress Progress Planner Plugin <= 0.9.2 is vulnerable to Cross Site Scripting (XSS)
Software Progress Planner Type Plugin Vulnerable versions = 0.9.2 Fixed in 0.9.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37422 Patch priority Medium CVSS severity Medium 6.5 Developer Emilia Projects PSID ae1b0a295095 Credits justakazh Required privilege...
WordPress Advanced Custom Fields PRO Plugin < 6.3.2 is vulnerable to Broken Access Control
Software Advanced Custom Fields PRO Type Plugin Vulnerable versions 6.3.2 Fixed in 6.3.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-37250 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 5d5f89be56d4 Credits Rafie Muhammad...
Malicious code in capistrano_auth-subscriber (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-6809 Malicious code in capistrano_auth-subscriber (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in campaign-monitor_subscriber (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-6383 Malicious code in action-subscriber (RubyGems)
--- -= Per source details. Do not edit below this line.=-...