CVE-2024-38714 WordPress WP Fast Total Search <= 1.68.232 - Broken Access Control vulnerability

Missing Authorization vulnerability in Epsiloncool WP Fast Total Search fulltext-search.This issue affects WP Fast Total Search: from n/a through = 1.68.232...

CVE-2024-38714

CVE-2024-38714 concerns WP Fast Total Search (Epsiloncool) with Missing Authorization due to incorrectly configured access control levels. Affected versions are WP Fast Total Search 1.68.232 and earlier. Public details in connected sources indicate the attack surface involves unauthorized access ...

CVE-2024-39640

CVE-2024-39640: WordPress WP Social Feed Gallery (insta-gallery)

CVE-2024-43146

CVE-2024-43146 is a Missing Authorization vulnerability in the AMP for WP (Accelerated Mobile Pages) WordPress plugin. The connected records identify AMP for WP versions up to and including 1.0.96.1 as affected, with the root cause described as misconfigured access control that allows exploitatio...

CVE-2024-43143

CVE-2024-43143 is a Missing Authorization vulnerability in the WordPress plugin Registrations for the Events Calendar (Roundup WP Registrations) affecting versions from n/a through 2.12.1. The connected sources confirm a broken access control issue allowing exploitation via misconfigured authoriz...

CVE-2024-43146 WordPress Accelerated Mobile Pages plugin <= 1.0.96.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Ahmed Kaludi, Mohammed Kaludi AMP for WP allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AMP for WP: from n/a through 1.0.96.1...

CVE-2024-43937

CVE-2024-43937 corresponds to a Missing Authorization vulnerability in WP Crowdfunding (Themeum) affecting WP Crowdfunding versions n/a through 2.1.10. Connected sources (PT-2024-30798) describe the issue as an unauthorized access/configuration flaw that lets attackers enable/disable addons due t...

CVE-2024-43937 WordPress WP Crowdfunding plugin <= 2.1.10 - Settings Change vulnerability

Missing Authorization vulnerability in Themeum WP Crowdfunding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Crowdfunding: from n/a through 2.1.10...

CVE-2024-43980

CVE-2024-43980 concerns CozyThemes Fota WP (FotaWP) with a Missing Authorization vulnerability due to incorrectly configured access control. Public sources indicate affecting Fota WP versions from n/a through 1.4.1. Multiple connected documents reference the patch status and fix guidance, noting ...

CVE-2024-44020

The CVE CVE-2024-44020 concerns the WP Free SSL – Free SSL Certificate for WordPress and force HTTPS plugin (≤ 1.2.6). Affected software: WordPress plugin WP Free SSL, versions up to 1.2.6. Vulnerability type: Missing Authorization / Broken Access Control. Reported impact indicates unauthorized a...

CVE-2024-47317

The CVE-2024-47317 entry covers a Missing Authorization/Broken Access Control issue in the WordPress plugin Ads by WPQuads (WPQuads Ads) versions up to 2.0.84. The vulnerability is due to incorrectly configured access control, enabling unauthorized access for subscribers. Patch details in the con...

CVE-2024-9655

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Icon widget in all versions up to, and including, 6.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. Thi...

CVE-2024-9655

CVE-2024-9655 affects Gutenberg Blocks with AI by Kadence WP – Page Builder Features (WordPress). It is a Stored Cross-Site Scripting via the Icon widget in all versions

CVE-2024-9655 Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Widget

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Icon widget in all versions up to, and including, 6.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. Thi...

PT-2024-30336 · Unknown · Amp For Wp

Name of the Vulnerable Software and Affected Versions: AMP for WP versions 1.0.96.1 and earlier Description: The issue affects AMP for WP due to a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. Recommendations: For versions...

PT-2024-30392 · Unknown · Wp Search Analytics

Name of the Vulnerable Software and Affected Versions: WP Search Analytics versions 1.4.9 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For WP Search Analytics...

WordPress WP Pocket URLs Plugin <= 1.0.3 is vulnerable to Cross Site Scripting (XSS)

Software WP Pocket URLs Type Plugin Vulnerable versions = 1.0.3 Fixed in 1.0.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-51681 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 80e05c72df93 Credits SOPROBRO Required privilege Contributor...

PT-2024-27557 · Automattic · Wp Job Manager - Resume Manager

Name of the Vulnerable Software and Affected Versions: WP Job Manager - Resume Manager versions through 2.1.0 Description: The issue is related to a Missing Authorization vulnerability in Automattic WP Job Manager - Resume Manager, which allows exploiting incorrectly configured access control...

PT-2024-27831 · WordPress · Wp Accessibility Helper

Name of the Vulnerable Software and Affected Versions: WP Accessibility Helper WAH versions 0.6.2.9 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by Access Control Lists ACLs. This means that...

PT-2024-30325 · WordPress · Wp Sunshine Sunshine Photo Cart

Name of the Vulnerable Software and Affected Versions: WP Sunshine Sunshine Photo Cart versions 3.2.1 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For WP...