CVE-2025-3418 WPC Admin Columns 2.0.6 - 2.1.0 - Authenticated (Subscriber+) Privilege Escalation via User Meta Update

The WPC Admin Columns plugin for WordPress is vulnerable to privilege escalation in versions 2.0.6 to 2.1.0. This is due to the plugin not properly restricting user meta values that can be updated through the ajaxeditsave function. This makes it possible for authenticated attackers, with...

CVE-2025-3418 WPC Admin Columns 2.0.6 - 2.1.0 - Authenticated (Subscriber+) Privilege Escalation via User Meta Update

The WPC Admin Columns plugin for WordPress is vulnerable to privilege escalation in versions 2.0.6 to 2.1.0. This is due to the plugin not properly restricting user meta values that can be updated through the ajaxeditsave function. This makes it possible for authenticated attackers, with...

CVE-2025-3418

CVE-2025-3418 affects WPC Admin Columns for WordPress. The issue is a privilege-escalation via the ajax_edit_save path: authenticated users with Subscriber+ can update their user meta to elevate to administrator, due to insufficient access control on that update. Root cause: missing/weak authoriz...

PT-2025-16169 · WordPress · Wpc Admin Columns

Name of the Vulnerable Software and Affected Versions: WPC Admin Columns plugin for WordPress versions 2.0.6 through 2.1.0 Description: The issue is related to privilege escalation due to the plugin not properly restricting user meta values that can be updated through the ajax edit save function...

WordPress WPC Admin Columns plugin 2.0.6-2.1.0 - Authenticated (Subscriber+) Privilege Escalation via User Meta Update vulnerability

Authenticated Subscriber+ Privilege Escalation via User Meta Update vulnerability discovered by kr0d in WordPress Plugin WPC Admin Columns versions 2.0.6-2.1.0...

CVE-2025-26657

SAP KMC WPC allows an unauthenticated attacker to remotely retrieve usernames by a simple parameter query which could expose sensitive information causing low impact on confidentiality of the application. This has no effect on integrity and availability...

CVE-2025-26657

SAP KMC WPC allows an unauthenticated attacker to remotely retrieve usernames by a simple parameter query which could expose sensitive information causing low impact on confidentiality of the application. This has no effect on integrity and availability...

CVE-2025-26657

CVE-2025-26657 is an information-disclosure vulnerability in SAP KMC WPC. An unauthenticated attacker can remotely retrieve usernames via a simple parameter query, exposing sensitive information and causing low confidentiality impact. The root cause is an information-disclosure flaw in the WPC co...

CVE-2025-26657 Information Disclosure vulnerability in SAP KMC WPC

SAP KMC WPC allows an unauthenticated attacker to remotely retrieve usernames by a simple parameter query which could expose sensitive information causing low impact on confidentiality of the application. This has no effect on integrity and availability...

CVE-2025-26657 Information Disclosure vulnerability in SAP KMC WPC

SAP KMC WPC allows an unauthenticated attacker to remotely retrieve usernames by a simple parameter query which could expose sensitive information causing low impact on confidentiality of the application. This has no effect on integrity and availability...

PT-2025-15366 · Sap · Sap Kmc Wpc

Name of the Vulnerable Software and Affected Versions: SAP KMC WPC affected versions not specified Description: The issue allows an unauthenticated attacker to remotely retrieve usernames by a simple parameter query, potentially exposing sensitive information and causing low impact on the...

CVE-2025-30825 WordPress WPC Smart Linked Products plugin <= 1.3.5 - Privilege Escalation vulnerability

Missing Authorization vulnerability in WPClever WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce wpc-smart-linked-products allows Privilege Escalation.This issue affects WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce: from n/a through = 1.3.5...

CVE-2025-30825

CVE-2025-30825 affects WPC Smart Linked Products – Upsells & Cross-sells for WooCommerce. It is a Missing Authorization vulnerability enabling Privilege Escalation, impacting versions up to 1.3.5. CVSS v3.1 base score 8.8 (HIGH). Connected docs indicate a patched fix in a later release (Patch Sta...

PT-2025-14393 · Woocommerce · Wpc Smart Linked Products - Upsells & Cross-Sells For Woocommerce

Name of the Vulnerable Software and Affected Versions: WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce versions 1.3.5 and earlier Description: The issue is related to a Missing Authorization vulnerability that allows Privilege Escalation. This vulnerability affects the WPC Smart...

Exploit for CVE-2025-30772

🚨 CVE-2025-30772 - Privilege Escalation in WPC Smart Upsell Fu...

WordPress WPC Smart Upsell Funnel for WooCommerce plugin <= 3.0.4 - Arbitrary Option Update to Privilege Escalation vulnerability

Arbitrary Option Update to Privilege Escalation vulnerability discovered by LVT-tholv2k in WordPress Plugin WPC Smart Upsell Funnel for WooCommerce versions = 3.0.4...

CVE-2025-30772 WordPress WPC Smart Upsell Funnel for WooCommerce plugin <= 3.0.4 - Arbitrary Option Update to Privilege Escalation vulnerability

Missing Authorization vulnerability in WPClever WPC Smart Upsell Funnel for WooCommerce wpc-smart-upsell-funnel allows Privilege Escalation.This issue affects WPC Smart Upsell Funnel for WooCommerce: from n/a through = 3.0.4...

PT-2025-13058 · Woocommerce · Wpc Smart Upsell Funnel

Name of the Vulnerable Software and Affected Versions: WPC Smart Upsell Funnel for WooCommerce versions 3.0.4 and earlier Description: The issue is related to a Missing Authorization vulnerability that allows Privilege Escalation in WPC Smart Upsell Funnel for WooCommerce. This vulnerability can ...

CVE-2024-12432

The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to account takeover and privilege escalation in all versions up to, and including, 1.2.8. This is due to the 'generatekey' function not producing a sufficiently random value. This makes it possible for authenticated...

CVE-2024-50416

Deserialization of Untrusted Data vulnerability in WPClever WPC Shop as a Customer for WooCommerce wpc-shop-as-customer allows Object Injection.This issue affects WPC Shop as a Customer for WooCommerce: from n/a through = 1.2.6...