CVE-2025-13529 Unify <= 3.4.9 - Missing Authorization to Unauthenticated Option Deletion via 'unify_plugin_downgrade' Parameter

The Unify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'init' action in all versions up to, and including, 3.4.9. This makes it possible for unauthenticated attackers to delete specific plugin options via the 'unifyplugindowngrad...

VulnCheck KEV: CVE-2022-34487

Unauthenticated Arbitrary Option Update vulnerability in biplob018's Shortcode Addons plugin = 3.0.2 at WordPress...

CVE-2021-24219 All Thrive Themes and Plugins - Unauthenticated Option Update

The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline Optimizer WordPress plugin before 1.3.7.3, Thrive Leads WordPress plugin before 2.3.9.4, Thrive Ultimatum WordPress plugin before 2.3.9.4, Thrive Quiz Builder WordPress plugin...

All Thrive Themes and Plugins - Unauthenticated Option Update

The plugins and themes register a REST API endpoint associated with Zapier functionality. While this endpoint was intended to require an API key in order to access, it was possible to access it by supplying an empty apikey parameter in vulnerable versions if Zapier was not enabled. Attackers coul...

Thrive Apprentice premium plugin <= 2.3.9.3 - Unauthenticated Option Update vulnerability

Unauthenticated Option Update vulnerability discovered by WordFence in Thrive Apprentice premium plugin versions = 2.3.9.3. Solution Update the Thrive Apprentice premium plugin to the latest available version at least 2.3.9.4...

WordPress Thrive Architect premium plugin <= 2.6.7.3 - Unauthenticated Option Update vulnerability

Unauthenticated Option Update vulnerability discovered by WordFence in WordPress Thrive Architect premium plugin versions = 2.6.7.3. Solution Update the WordPress Thrive Architect premium plugin to the latest available version at least 2.6.7.4...

CVE-2019-17228

includes/options.php in the motors-car-dealership-classified-listings aka Motors - Car Dealer & Classified Ads plugin through 1.4.0 for WordPress allows unauthenticated options changes...

CVE-2019-19982

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option creation. In order to exploit this vulnerability, an attacker would need to send a /wp-admin/admin-post.php?esskip=1&optionname= request...

CVE-2019-19982

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option creation. In order to exploit this vulnerability, an attacker would need to send a /wp-admin/admin-post.php?esskip=1&optionname= request...

WordPress Email Subscribers & Newsletters Unauthenticated Options Creation Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Email Subscribers & Newsletters is an email subscription and newsletter plugin used in it. An unauthenticated option creation...

WordPress Simple 301 Redirects Addon Bulk Uploader plugin <= 1.2.4 - Unauthenticated option changes and other security issues

Unauthenticated option changes and other security issues found by Jerome Bruandet Nintechnet in WordPress Simple 301 Redirects Addon Bulk Uploader plugin versions = 1.2.4. Solution Update the WordPress Simple 301 Redirects Addon Bulk Uploader plugin to the latest available version at least 1.2.5...