Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3,671

Export CSV
CVE-2024-12132

WP Job Portal – A Complete Recruitment System for Company or Job Board website <= 2.2.4 - Authenticated (Subscriber+) Insecure Direct Object Reference

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.4 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create jobs for companies that are unaffiliated with the attacker.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wpjobportal
Products
Wp Job Portal
CVE-2024-12059

ElementInvader Addons for Elementor <= 1.3.1 - Missing Authorization to Arbitrary Options Read

The ElementInvader Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.1 via the eli_option_value shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract arbitrary options from the wp_options table.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Elementinvader
Products
Elementinvader Addons For Elementor
CVE-2022-3459

WooCommerce Multiple Free Gift <= 1.2.3 - Insufficient Server-Side Validation to Arbitrary Gift Adding

The WooCommerce Multiple Free Gift plugin for WordPress is vulnerable to gift manipulation in all versions up to, and including, 1.2.3. This is due to plugin not enforcing server-side checks on the products that can be added as a gift. This makes it possible for unauthenticated attackers to add non-gift items to their cart as a gift.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Lilmonkee
Products
Woocommerce Multiple Free Gift
CVE-2024-5942

Page and Post Clone <= 6.0 - Insecure Direct Object Reference to Authenticated (Author+) Sensitive Information Exposure

The Page and Post Clone plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0 via the 'content_clone' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to clone and read private posts.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Carlosfazenda
Products
Page And Post Clone
CVE-2024-5639

User Profile Picture <= 2.6.1 - Authenticated (Author+) Insecure Direct Object Reference to Profile Picture Update

The User Profile Picture plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.6.1 via the 'rest_api_change_profile_image' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to update the profile picture of any user.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Cozmoslabs
Products
User Profile Picture
CVE-2024-5438

Tutor LMS – eLearning and online course solution <= 2.7.1 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Quiz Attempt Deletion

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.1 via the 'attempt_delete' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Instructor-level access and above, to delete arbitrary quiz attempts.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Themeum
Products
Tutor Lms
CVE-2024-1289

LearnPress <= 4.2.6.3 - Insecure Direct Object Reference

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.6.3 due to missing validation on a user controlled key when looking up order information. This makes it possible for authenticated attackers to obtain information on orders placed by other users and guests, which can be leveraged to sign up for paid courses that were purchased by guests. Emails of other users are also exposed.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Thimpress
Products
Learnpress
CVE-2024-12472

Post Duplicator <= 2.36 - Authenticated (Contributor+) Protected Post Disclosure

The Post Duplicator plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.36 via the mtphr_duplicate_post() function due to insufficient restrictions on which posts can be duplicated. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to by duplicating the post.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Metaphorcreations
Products
Post Duplicator
CVE-2024-10778

BuddyPress Builder for Elementor – BuddyBuilder <= 1.7.4 - Authenticated (Contributor+) Post Disclosure

The BuddyPress Builder for Elementor – BuddyBuilder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.4 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts crated by Elementor that they should not have access to.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Staxwp
Products
Buddybuilder
CVE-2024-0839

FeedWordPress <= 2022.0222 - Insecure Direct Object Referece

The FeedWordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2022.0222 due to missing validation on the user controlled 'guid' key. This makes it possible for unauthenticated attackers to view draft posts that may contain sensitive information.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Feedwordpress Project
Products
Feedwordpress
CVE-2023-6983

Display custom fields in the frontend – Post and User Profile Fields <= 1.2.1 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Meta Disclosure

The Display custom fields in the frontend – Post and User Profile Fields plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.1 via the vg_display_data shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to retrieve potentially sensitive post meta.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Josevega
Products
Display Custom Fields In The Frontend - Post And User Profile Fields
CVE-2023-6897

EAN for WooCommerce <= 4.9.2 - Insecure Direct Object Reference to Sensitve Information Exposure via Shortcode

The EAN for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.9.2 via the the 'alg_wc_ean_product_meta' shortcode due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to expose potentially sensitive post metadata.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wpfactory
Products
Ean For Woocommerce
CVE-2023-6223

LearnPress <= 4.2.5.7 - Insecure Direct Object Reference to Information Disclosure

The LearnPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.5.7 via the /wp-json/lp/v1/profile/course-tab REST API due to missing validation on the 'userID' user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve the details of another user's course progress.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Thimpress
Products
Learnpress
CVE-2023-3105

LearnDash LMS <= 4.6.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password Change

The LearnDash LMS plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 4.6.0. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for attackers with with existing account access at any level, to change user passwords and potentially take over administrator accounts.

CVSS 3.1 · 8.8 High EPSS 2.2% KEV · Not listed
Vendors
Learndash
Products
Learndash
CVE-2024-12131

WP Job Portal – A Complete Recruitment System for Company or Job Board website <= 2.2.5- Authenticated (Subscriber+) Insecure Direct Object Reference

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.5 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to submit resumes for other applicants when applying for jobs.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wpjobportal
Products
Wp Job Portal
CVE-2023-0694

Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf shortcode

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about any standard form field of any form submission.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wpmet
Products
Metform Elementor Contact Form Builder
CVE-2023-0693

Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_transaction_id' shortcode

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_transaction_id' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about the transaction ids of arbitrary form submissions that included payment.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wpmet
Products
Metform Elementor Contact Form Builder
CVE-2024-8123

The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Insecure Direct Object Reference

The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.0.8 via the duplicate_post function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to duplicate posts written by other authors including admins. This includes the ability to duplicate password-protected posts, which reveals their contents.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wpextended
Products
Wp Extended
CVE-2024-10780

Restaurant & Cafe Addon for Elementor <= 1.5.9 - Authenticated (Contributor+) Post Disclosure

The Restaurant & Cafe Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.5.9 via the 'narestaurant_elementor_template' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from private or draft posts created by Elementor that they should not have access to.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Nicheaddons Wordpress
Products
Restaurant & Cafe Addon For Elementor Restaurant \& Cafe Addon For Elementor Wordpress
CVE-2024-13428

WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Unauthenticated Company Logo Deletion

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.6 via the deleteCompanyLogo() due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to delete arbitrary company logos.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wpjobportal
Products
Wp Job Portal