CVE-2024-13800

The CVE-2024-13800 entry concerns the WordPress ConvertPlus plugin. A missing capability check on the cp_dismiss_notice AJAX endpoint allows authenticated users with Subscriber-level access and above to perform unauthorized modifications of data, enabling updates to option values (to '1') that ca...

CVE-2019-15863

CVE-2019-15863 affects the WordPress ConvertPlus plugin prior to version 3.4.5. The vulnerability allows unintended account creation (with the none role) via a request for variants, enabling an unauthorized user to create accounts through the plugin’s variant request flow. Impact is user creation...