Lucene search
+L

3434 matches found

Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2025/12/15 12:00 a.m.•1 views

CVE-2025-14003: Missing Authorization

The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the addimagestogallerycallback function in all versions up to, and including, 2.13.3. This makes it possible for authenticated attackers, wit...

4.3CVSS5.8AI score0.00243EPSS
SaveExploits0References1
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2025/12/15 12:00 a.m.•0 views

CVE-2025-13950: Missing Authorization

The OneSignal – Web Push Notifications plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the settings handling functionality in all versions up to, and including, 3.6.1. This is due to the plugin processing POST requests without verifying...

5.3CVSS5.7AI score0.00315EPSS
SaveExploits0References1
NVD
NVD
•added 2025/12/13 4:16 p.m.•17 views

CVE-2025-14395

The Popover Windows plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple ajax actions e.g., popsubmit, popthemesubmit in all versions up to, and including, 1.2. This makes it possible for authenticated attackers, with subscriber-lev...

4.3CVSS0.00188EPSS
SaveExploits0References2
NVD
NVD
•added 2025/12/13 4:16 p.m.•13 views

CVE-2025-14288

The Gallery Blocks with Lightbox. Image Gallery, HTML5 video , YouTube, Vimeo Video Gallery and Lightbox for native gallery plugin for WordPress is vulnerable to unauthorized modification of plugin settings in all versions up to, and including, 3.3.0. This is due to the plugin using the editposts...

4.3CVSS0.00225EPSS
SaveExploits0References3
Cvelist
Cvelist
•added 2025/12/13 4:31 a.m.•55 views

CVE-2025-14288 Gallery Blocks with Lightbox <= 3.3.0 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Modification

The Gallery Blocks with Lightbox. Image Gallery, HTML5 video , YouTube, Vimeo Video Gallery and Lightbox for native gallery plugin for WordPress is vulnerable to unauthorized modification of plugin settings in all versions up to, and including, 3.3.0. This is due to the plugin using the editposts...

4.3CVSS0.00225EPSS
SaveExploits0References3
CVE
CVE
•added 2025/12/13 4:31 a.m.•29 views

CVE-2025-14447

CVE-2025-14447 : WordPress plugin AnnunciFunebri Impresa (plugins/annuncifunebri-onoranza) versions

4.3CVSS4.7AI score0.00293EPSS
SaveExploits0References4
Cvelist
Cvelist
•added 2025/12/13 4:31 a.m.•45 views

CVE-2025-14447 AnnunciFunebri Impresa <= 4.7.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Options Deletion

The AnnunciFunebri Impresa plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the annfuresetoptions function in all versions up to, and including, 4.7.0. This makes it possible for authenticated attackers, with Subscriber-level access and...

4.3CVSS0.00293EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment
•added 2025/12/13 4:31 a.m.•11 views

CVE-2025-14395 Popover Windows <= 1.2 - Missing Authorization to Authenticated (Subscriber+) Popover Configuration Update via AJAX Actions

The Popover Windows plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple ajax actions e.g., popsubmit, popthemesubmit in all versions up to, and including, 1.2. This makes it possible for authenticated attackers, with subscriber-lev...

4.3CVSS4.8AI score0.00188EPSS
SaveExploits0References2
Cvelist
Cvelist
•added 2025/12/13 4:31 a.m.•42 views

CVE-2025-14395 Popover Windows <= 1.2 - Missing Authorization to Authenticated (Subscriber+) Popover Configuration Update via AJAX Actions

The Popover Windows plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple ajax actions e.g., popsubmit, popthemesubmit in all versions up to, and including, 1.2. This makes it possible for authenticated attackers, with subscriber-lev...

4.3CVSS0.00188EPSS
SaveExploits0References2
CVE
CVE
•added 2025/12/13 4:31 a.m.•28 views

CVE-2025-14395

The CVE CVE-2025-14395 concerns the Popover Windows WordPress plugin (versions

4.3CVSS4.8AI score0.00188EPSS
SaveExploits0References2
RedhatCVE
RedhatCVE
•added 2025/12/13 3:59 a.m.•13 views

CVE-2025-13314

The Product Filtering by Categories, Tags, Price Range for WooCommerce – Filter Plus plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.1.6 due to a missing capability check on the 'filtersavesettings' and 'addfilteroptions' AJAX action...

5.3CVSS6AI score0.00284EPSS
SaveExploits0References1
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2025/12/13 12:00 a.m.•3 views

CVE-2025-13093: Missing Authorization

The Devs CRM – Manage tasks, attendance and teams all together plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/devs-crm/v1/bulk-update' REST-API endpoint in all versions up to, and including, 1.1.8. This makes it possible...

5.3CVSS5.7AI score0.00273EPSS
SaveExploits0References1
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2025/12/13 12:00 a.m.•2 views

CVE-2025-14447: Missing Authorization

The AnnunciFunebri Impresa plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the annfuresetoptions function in all versions up to, and including, 4.7.0. This makes it possible for authenticated attackers, with Subscriber-level access and...

4.3CVSS5.7AI score0.00293EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
•added 2025/12/13 12:00 a.m.•14 views

PT-2025-51074

The AnnunciFunebri Impresa plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the annfu reset options function in all versions up to, and including, 4.7.0. This makes it possible for authenticated attackers, with Subscriber-level access an...

5.3CVSS5.1AI score0.00293EPSS
SaveExploits0References3
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2025/12/13 12:00 a.m.•2 views

CVE-2025-14446: Missing Authorization

The Popup Builder Easy Notify Lite plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the easynotifycpreset function in all versions up to, and including, 1.1.37. This makes it possible for authenticated attackers, with Subscriber-level...

5.4CVSS5.7AI score0.00252EPSS
SaveExploits0References1
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2025/12/13 12:00 a.m.•1 views

CVE-2025-14288: Missing Authorization

The Gallery Blocks with Lightbox. Image Gallery, HTML5 video , YouTube, Vimeo Video Gallery and Lightbox for native gallery plugin for WordPress is vulnerable to unauthorized modification of plugin settings in all versions up to, and including, 3.3.0. This is due to the plugin using the editposts...

4.3CVSS5.8AI score0.00225EPSS
SaveExploits0References1
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2025/12/13 12:00 a.m.•3 views

CVE-2025-11164: Missing Authorization

The Mavix Education theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mavixeducationactivateplugin' AJAX action in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with Subscriber-level acces...

4.3CVSS5.7AI score0.00188EPSS
SaveExploits0References1
NVD
NVD
•added 2025/12/12 4:15 a.m.•32 views

CVE-2025-14392

The Simple Theme Changer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the userthemeadmin, displaymethodadmin, and setchangethemebuttonname actions actions in all versions up to, and including, 1.0. This makes it possible for...

4.3CVSS0.00188EPSS
SaveExploits0References2
CVE
CVE
•added 2025/12/12 3:20 a.m.•25 views

CVE-2025-13314

CVE-2025-13314 affects the WordPress plugin Filter Plus – Product Filtering by Categories, Tags, Price Range for WooCommerce (Filter Plus) up to version 1.1.5. The issue is caused by missing capability checks on two AJAX actions, filter_save_settings and add_filter_options , allowing unauthentica...

5.3CVSS6AI score0.00284EPSS
SaveExploits0References6
Cvelist
Cvelist
•added 2025/12/12 3:20 a.m.•44 views

CVE-2025-14392 Simple Theme Changer <= 1.0. - Missing Authorization to Plugin Settings Update via AJAX Actions

The Simple Theme Changer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the userthemeadmin, displaymethodadmin, and setchangethemebuttonname actions actions in all versions up to, and including, 1.0. This makes it possible for...

4.3CVSS0.00188EPSS
SaveExploits0References2
Rows per page
Query Builder