Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 9,516

Export CSV
CVE-2024-1492

WPify Woo Czech <= 4.0.8 - Missing Authorization

The WPify Woo Czech plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the maybe_send_to_packeta function in all versions up to, and including, 4.0.8. This makes it possible for unauthenticated attackers to obtain shipping details for orders as long as the order number is known.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wpify
Products
Woo Czech Wpify Woo Czech
CVE-2024-1478

Maintenance Mode <= 3.0.1 - Information Exposure

The Maintenance Mode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.1 via the REST API. This makes it possible for unauthenticated attackers to obtain post and page content via API thus bypassing the content protection provided by the plugin.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Helderk
Products
Maintenance Mode
CVE-2024-1475

Coming Soon Maintenance Mode <= 1.0.5 - Information Exposure

The Coming Soon Maintenance Mode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.5 via the REST API. This makes it possible for unauthenticated attackers to obtain post and page content thus bypassing the protection provided by the plugin.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Awplife
Products
Coming Soon Maintenance Mode
CVE-2024-1473

Coming Soon & Maintenance Mode by Colorlib <= 1.0.99 - Information Exposure

The Coming Soon & Maintenance Mode by Colorlib plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.99 via the REST API. This makes it possible for unauthenticated attackers to obtain post and page contents via REST API thus bypassing maintenance mode protection provided by the plugin.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Colorlib
Products
Coming Soon \& Maintenance Mode
CVE-2024-1472

WP Maintenance <= 6.1.6 - Information Exposure

The WP Maintenance plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 6.1.6 via the REST API. This makes it possible for unauthenticated attackers to bypass the plugin's maintenance mode obtain post and page content via REST API.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Restezconnectes Wordpress
Products
Wp Maintenance Wordpress
CVE-2024-1462

Maintenance Page <= 1.0.8 - Security Mechanism Bypass via REST API

The Maintenance Page plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and including, 1.0.8 via the REST API. This makes it possible for unauthenticated attackers to view post titles and content when the site is in maintenance mode.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Themegrill
Products
Maintenance Page
CVE-2024-1376

Event post <= 5.9.4 - Missing Authorization

The Event post plugin for WordPress is vulnerable to unauthorized bulk metadata update due to a missing capability check on the save_bulkdatas function in all versions up to, and including, 5.9.4. This makes it possible for authenticated attackers, with subscriber access or higher, to update post_meta_data.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Avecnous
Products
Event Post
CVE-2024-1092

RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.4.1 - Missing Authorization

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the feedzy dashboard in all versions up to, and including, 4.4.1. This makes it possible for authenticated attackers, with contributor access or higher, to create, edit or delete feed categories created by them.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Themeisle
Products
Rss Aggregator By Feedzy
CVE-2024-1088

Password Protected Store for WooCommerce <= 2.2 - Information Exposure via REST API

The Password Protected Store for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2 via the REST API. This makes it possible for unauthenticated attackers to extract sensitive data including post titles and content.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Geek Code Lab Rajkakadiya
Products
Password Protected Store Password Protected Store For Woocommerce
CVE-2024-1044

Customer Reviews for WooCommerce <= 5.38.10 - Improper Authorization via submit_review

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submit_review' function in all versions up to, and including, 5.38.12. This makes it possible for unauthenticated attackers to submit reviews with arbitrary email addresses regardless of whether reviews are globally enabled.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Cusrev
Products
Customer Reviews For Woocommerce
CVE-2024-11868

LearnPress – WordPress LMS Plugin <= 4.2.7.3 - Course Material Sensitive Information Exposure via REST API

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.7.3 via class-lp-rest-material-controller.php. This makes it possible for unauthenticated attackers to extract potentially sensitive paid course material.

CVSS 3.1 · 5.3 Medium EPSS 1.2% KEV · Not listed
Vendors
Thimpress
Products
Learnpress
CVE-2024-0978

My Private Site <= 3.0.14 - Improper Access Control to Sensitive Information Exposure via REST API

The My Private Site plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.14 via the REST API. This makes it possible for unauthenticated attackers to bypass the plugin's site privacy feature and view restricted page and post content.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Zatzlabs
Products
Wordpress My Private Site
CVE-2024-0975

WordPress Access Control <= 4.0.13 - Improper Access Control to Sensitive Information Exposure via REST API

The WordPress Access Control plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.13 via the REST API. This makes it possible for unauthenticated attackers to bypass the plugin's "Make Website Members Only" feature (when unset) and view restricted page and post content.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Brandonwamboldt
Products
Wordpress Access Control
CVE-2024-0766

Envo's Elementor Templates & Widgets for WooCommerce <= 1.4.4 - Missing Authorization via templates_ajax_request

The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the templates_ajax_request function in all versions up to, and including, 1.4.4. This makes it possible for subscribers and higher to create templates.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Envothemes
Products
Envo\'s Elementor Templates \& Widgets For Woocommerce
CVE-2024-0453

AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_delete_callback

The AI ChatBot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the openai_file_delete_callback function in all versions up to, and including, 5.3.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete files from a linked OpenAI account.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Quantumcloud
Products
Wpbot
CVE-2024-0452

AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_upload_callback

The AI ChatBot plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the openai_file_upload_callback function in all versions up to, and including, 5.3.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files to a linked OpenAI account.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Quantumcloud
Products
Wpbot
CVE-2024-0374

Views for WPForms <= 3.2.2 - Cross-Site Request Forgery via create_view

The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.2. This is due to missing or incorrect nonce validation on the 'create_view' function. This makes it possible for unauthenticated attackers to create views via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Formviewswp
Products
Views For Wpforms
CVE-2024-0370

Views for WPForms <= 3.2.2 - Missing Authorization via save_view

The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_view' function in all versions up to, and including, 3.2.2. This makes it possible for authenticated attackers, with subscriber access and above, to modify the titles of arbitrary posts.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Formviewswp
Products
Views For Wpforms
CVE-2023-6966

The Moneytizer <= 9.6.3 - Missing Authorization via multiple AJAX actions

The The Moneytizer plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missing capability check on multiple AJAX functions in the /core/core_ajax.php file in all versions up to, and including, 9.6.3. This makes it possible for authenticated attackers, with subscriber access and above, to update and retrieve billing and bank details, update and reset the plugin's settings, and update languages as well as other lower-severity actions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Themoneytizer
Products
The Moneytizer
CVE-2023-6785

Download Manager <= 3.2.84 - Missing Authorization

The Download Manager plugin for WordPress is vulnerable to unauthorized file download of files added via the plugin in all versions up to, and including, 3.2.84. This makes it possible for unauthenticated attackers to download files added with the plugin (even when privately published).

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
W3eden
Products
Download Manager