16570 matches found
CVE-2024-12386
The CVE-2024-12386 entry concerns the WP Abstracts WordPress plugin (prevalent versions up to 2.7.3) and documents a Cross-Site Request Forgery (CSRF) flaw caused by missing nonce validation in multiple functions. Exploitation requires an administrator to perform an action (e.g., click a forged l...
CVE-2024-12386 WP Abstracts <= 2.7.3 - Cross-Site Request Forgery to Arbitrary Account Deletion
The WP Abstracts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.3. This is due to missing nonce validation on multiple functions. This makes it possible for unauthenticated attackers to delete arbitrary accounts via a forged request...
CVE-2024-12213
The WP Job Board Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to 2.3.16. This is due to the plugin allowing a user to supply the 'role' field when registering. This makes it possible for unauthenticated attackers to register as an administrator on vulnerable...
CVE-2024-12213
CVE-2024-12213 affects the WordPress plugin WP Job Board Pro, where an attacker can specify the role during user registration, enabling unauthenticated privilege escalation to administrator on vulnerable sites. Technical details in connected docs indicate the issue arises from processing the regi...
CVE-2024-12213 WP Job Board Pro < 1.2.85 - Unauthenticated Privilege Escalation via process_register
The WP Job Board Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to 2.3.16. This is due to the plugin allowing a user to supply the 'role' field when registering. This makes it possible for unauthenticated attackers to register as an administrator on vulnerable...
CVE-2024-12213 WP Job Board Pro < 1.2.85 - Unauthenticated Privilege Escalation via process_register
The WP Job Board Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to 2.3.16. This is due to the plugin allowing a user to supply the 'role' field when registering. This makes it possible for unauthenticated attackers to register as an administrator on vulnerable...
CVE-2024-13794
The WP Ghost Hide My WP Ghost – Security & Firewall plugin for WordPress is vulnerable to Login Page Dislcosure in all versions up to, and including, 5.3.02. This is due to the plugin not properly restricting the /wp-register.php path. This makes it possible for unauthenticated attackers to...
CVE-2024-13794 Hide My WP Ghost – Security & Firewall <= 5.3.02 - Unauthenticated Login Page Disclosure
The WP Ghost Hide My WP Ghost – Security & Firewall plugin for WordPress is vulnerable to Login Page Dislcosure in all versions up to, and including, 5.3.02. This is due to the plugin not properly restricting the /wp-register.php path. This makes it possible for unauthenticated attackers to...
CVE-2024-13794
CVE-2024-13794 affects the WordPress plugin WP Ghost (Hide My WP Ghost) and enables unauthenticated disclosure of the hidden login page by improperly restricting the /wp-register.php path in versions up to 5.3.02. The issue is categorized as a Network attack with Medium severity (CVSS v3.1 base s...
CVE-2024-13821 WP Booking Calendar <= 10.10 - Unauthenticated Post-Confirmation Booking Manipulation
The WP Booking Calendar plugin for WordPress is vulnerable to Unauthenticated Post-Confirmation Booking Manipulation in all versions up to, and including, 10.10. This is due to the plugin not properly requiring re-verification after a booking has been made and a change is being attempted. This...
CVE-2024-13821 WP Booking Calendar <= 10.10 - Unauthenticated Post-Confirmation Booking Manipulation
The WP Booking Calendar plugin for WordPress is vulnerable to Unauthenticated Post-Confirmation Booking Manipulation in all versions up to, and including, 10.10. This is due to the plugin not properly requiring re-verification after a booking has been made and a change is being attempted. This...
CVE-2024-13821
CVE-2024-13821 concerns the WordPress plugin WP Booking Calendar (<= 10.10). The defect allows unauthenticated actors to manipulate their confirmed bookings after approval because re-verification after a booking change is not enforced. The CVSS 3.1 base score is 5.3 (Network, Low complexity, N...
CVE-2024-13374
The WP Table Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on thewptmgetFolders AJAX action in all versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read...
CVE-2024-13374
Summary (CVE-2024-13374) The WordPress plugin WP Table Manager is affected up to version 4.1.3 . The vulnerability stems from a missing capability check in the AJAX action thewptm_getFolders , allowing authenticated attackers with Subscriber-level access or higher to read arbitrary file names and...
CVE-2024-13374 WP Table Manager <= 4.1.3 - Missing Authorization to Authenticated (Subscriber+) Directory Traversal to Folder/File Name Disclosure
The WP Table Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on thewptmgetFolders AJAX action in all versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read...
CVE-2024-13374 WP Table Manager <= 4.1.3 - Missing Authorization to Authenticated (Subscriber+) Directory Traversal to Folder/File Name Disclosure
The WP Table Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on thewptmgetFolders AJAX action in all versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read...
CVE-2024-13554
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reorderroute function in all versions up to, and including, 3.0.13. This makes it possible for unauthenticated attackers to reorder pos...
CVE-2024-13554
CVE-2024-13554 affects The Ultimate WordPress Toolkit – WP Extended
CVE-2024-13554 The Ultimate WordPress Toolkit – WP Extended <= 3.0.13 - Missing Authorization to Unauthenticated Post Order Manipulation
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reorderroute function in all versions up to, and including, 3.0.13. This makes it possible for unauthenticated attackers to reorder pos...
WordPress WP Ultimate Exporter plugin <= 2.9.3 - Information Disclosure Through Unprotected Directory vulnerability
Information Disclosure Through Unprotected Directory vulnerability discovered by Webbernaut in WordPress Plugin WP Ultimate Exporter versions = 2.9.3...