79146 matches found
CVE-2025-14947
The All-in-One Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxcallbackcreatebunnystreamvideo, ajaxcallbackgetbunnystreamvideo, and ajaxcallbackdeletebunnystreamvideo functions in all versions up to, and including,...
CVE-2025-14947 All-in-One Video Gallery <= 4.6.4 - Missing Authorization to Unauthenticated Bunny Stream Video Creation/Deletion
The All-in-One Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxcallbackcreatebunnystreamvideo, ajaxcallbackgetbunnystreamvideo, and ajaxcallbackdeletebunnystreamvideo functions in all versions up to, and including,...
CVE-2026-24598
Missing Authorization vulnerability in bestwebsoft Multilanguage by BestWebSoft multilanguage allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Multilanguage by BestWebSoft: from n/a through = 1.5.2...
CVE-2026-24536
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in webpushr Webpushr webpushr-web-push-notifications allows Retrieve Embedded Sensitive Data.This issue affects Webpushr: from n/a through = 4.38.0...
CVE-2026-24523
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Marcus aka @msykes WP FullCalendar wp-fullcalendar allows Retrieve Embedded Sensitive Data.This issue affects WP FullCalendar: from n/a through = 1.6...
CVE-2026-24636 WordPress Sugar Calendar (Lite) plugin <= 3.9.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Syed Balkhi Sugar Calendar Lite sugar-calendar-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sugar Calendar Lite: from n/a through = 3.9.1...
CVE-2026-24633 WordPress Add Expires Headers & Optimized Minify plugin <= 3.2.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in Passionate Brains Add Expires Headers & Optimized Minify add-expires-headers allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Add Expires Headers & Optimized Minify: from n/a through = 3.2.0...
CVE-2026-24612
CVE-2026-24612 is a missing Authorization vulnerability in the WordPress plugin/theme Orchid Store (theme version 1.5.15) or apply vendor-provided fixes once available. If no upgrade is feasible, monitor for official patches and advisories from the vendor.
CVE-2026-24613
CVE-2026-24613 describes a Missing/Broken Access Control issue in the Ecwid by Lightspeed Ecommerce Shopping Cart (WordPress plugin) up to version 7.0.5. The vulnerability stems from incorrectly configured access control allowing unauthorized access. CVSSv3.1 base score is 5.3 (Medium). Red Hat/R...
CVE-2026-24606
CVE-2026-24606 is a Missing Authorization (Broken Access Control) vulnerability in Bayarcash WooCommerce (bayarcash-wc) up to and including version 4.3.11 (and patched up to 4.3.12 per Patchstack). Exploitation relies on incorrectly configured access control security levels. Affected product: Bay...
CVE-2026-24607 WordPress Travel Monster theme <= 1.3.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in wptravelengine Travel Monster travel-monster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travel Monster: from n/a through = 1.3.3...
CVE-2026-24604
CVE-2026-24604 is a Missing Authorization / Broken Access Control issue in the WordPress plugin Simple GDPR Cookie Compliance (themebeez Simple GDPR Cookie Compliance). public records show vulnerability exists in versions up to and including 2.0.0 and is due to incorrectly configured access contr...
CVE-2026-24593
CVE-2026-24593 affects the WordPress plugin AWP Classifieds (versions 4.4.3 or apply vendor-provided fixes as they become available. (Mode C, details-supported, no speculation.)
CVE-2026-24593 WordPress AWP Classifieds plugin <= 4.4.3 - Sensitive Data Exposure vulnerability
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Strategy11 Team AWP Classifieds another-wordpress-classifieds-plugin allows Retrieve Embedded Sensitive Data.This issue affects AWP Classifieds: from n/a through = 4.4.3...
CVE-2026-24593 WordPress AWP Classifieds plugin <= 4.4.3 - Sensitive Data Exposure vulnerability
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Strategy11 Team AWP Classifieds another-wordpress-classifieds-plugin allows Retrieve Embedded Sensitive Data.This issue affects AWP Classifieds: from n/a through = 4.4.3...
CVE-2026-24587 WordPress AJAX Hits Counter + Popular Posts Widget plugin <= 0.10.210305 - Broken Access Control vulnerability
Missing Authorization vulnerability in kutsy AJAX Hits Counter + Popular Posts Widget ajax-hits-counter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AJAX Hits Counter + Popular Posts Widget: from n/a through = 0.10.210305...
CVE-2026-24587
CVE-2026-24587 affects the WordPress plugin AJAX Hits Counter + Popular Posts Widget (ajax-hits-counter). Connected sources confirm a Missing Authorization / Broken Access Control vulnerability in this plugin, affecting versions up to and including 0.10.210305. Core details from Red Hat/NVD/CVE l...
CVE-2026-24583 WordPress SumUp Payment Gateway For WooCommerce plugin <= 2.7.9 - Broken Access Control vulnerability
Missing Authorization vulnerability in sumup SumUp Payment Gateway For WooCommerce sumup-payment-gateway-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SumUp Payment Gateway For WooCommerce: from n/a through = 2.7.9...
CVE-2026-24562
CVE-2026-24562 : A Missing/Broken Access Control vulnerability in the Ryviu – Product Reviews for WooCommerce WordPress plugin (versions up to and including 3.1.26) allows access level misconfigurations. The NVD entry lists CVSSv3.1 base score 5.3 (Network, Low attack complexity, No privileges re...