PT-2025-3421

Name of the Vulnerable Software and Affected Versions Prolink 4G LTE Mobile Wi-Fi DL-7203E version 4.0.0B05 Description The issue allows an attacker to manipulate SQL queries by injecting malicious SQL code into the order by parameter in the "/reqproc/proc get" endpoint. This enables the attacker...

CVE-2024-12041

The Directorist: AI-Powered WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 8.0.12 via the /wp-json/directorist/v1/users/ endpoint. This makes it possible for unauthenticated attacker...

CVE-2024-13651

The RapidLoad – Optimize Web Vitals Automatically plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxdeactivate function in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with...

CVE-2024-12620

CVE-2024-12620 : The AnimateGL Animations for WordPress – Elementor & Gutenberg Blocks Animations plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the agl_json AJAX action in all versions up to and including 1.4.23 . This allows unauthentic...

CVE-2024-12825: Missing Authorization

The Custom Related Posts plugin for WordPress is vulnerable to unauthorized access & modification of data due to a missing capability check on three AJAX actions in all versions up to, and including, 1.7.3. This makes it possible for authenticated attackers, with Subscriber-level access and above...

WordPress plugin RapidLoad has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

WordPress plugin AnimateGL Animations for WordPress has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-12822

The Media Manager for UserPro plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the addcaptoimg function in all versions up to, and including, 3.11.0. This makes it possible for unauthenticated...

CVE-2024-11583

The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'removezippedfont' function in all versions up to, and including, 1.5.9. This makes it possible for...

CVE-2024-10591 MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics <= 1.5.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Options Update

The MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the hubwoosaveupdates function in all version...

CVE-2024-12129 Royal Core <= 2.9.2 - Authenticated (Subscriber+) Arbitrary Options Update

The Royal Core plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'royalrestorebackup' function in all versions up to, and including, 2.9.2. This makes it possible for authenticated attackers, with...

CVE-2024-13715 zStore Manager Basic <= 3.311 - Missing Authorization to Authenticated (Subscriber+) Cache Clearing

The zStore Manager Basic plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the zstoreclearcache function in all versions up to, and including, 3.311. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

CVE-2024-13646 Single-user-chat <= 0.5 - Authenticated (Subscriber+) Limited Options Update

The Single-user-chat plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to insufficient validation on the 'singleuserchatupdatelogin' function in all versions up to, and including, 0.5. This makes it possible for authenticated attacker...

CVE-2024-13652

Summary: CVE-2024-13652 affects the WordPress plugin ECPay Ecommerce for WooCommerce, version range up to and including 1.1.2411060. The vulnerability arises from a missing capability check on the AJAX action clear_ecpay_debug_log, enabling authenticated users with Subscriber-level access or high...

WordPress plugin “Single-user-chat” has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin zStore Manager Basic has security vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin Safe Ai Malware Protection for WP security vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

WordPress plugin Borderless has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

12 Step Meeting List < 3.16.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Content Deletion

Description The 12 Step Meeting List plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wpajaxtsmldelete function in all versions up to, and including, 3.16.5. This makes it possible for authenticated attackers, with Contributor-level access a...

CVE-2024-22316 IBM Sterling File Gateway improper access control

IBM Sterling File Gateway 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.1 could allow an authenticated user to perform unauthorized actions to another user's data due to improper access controls...