Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 12,018

Export CSV
CVE-2024-3213

Relevanssi – A Better Search <= 4.22.1 - Missing Authorization to Unauthenticated Count Option Update

The Relevanssi – A Better Search plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the relevanssi_update_counts() function in all versions up to, and including, 4.22.1. This makes it possible for unauthenticated attackers to execute expensive queries on the application that could lead into DOS.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Relevanssi
Products
Relevanssi
CVE-2024-2844

Easy Appointments <= 3.11.18 - Insufficient Authorization

The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to insufficient user validation on the ajax_cancel_appointment() function in all versions up to, and including, 3.11.18. This makes it possible for unauthenticated attackers to cancel other users orders.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Easy-appointments Easyappointments
Products
Easy Appointments Easyappointments
CVE-2024-2017

Countdown, Coming Soon, Maintenance – Countdown & Clock <= 2.7.8 - Missing Authorization to Authenticated (Subscriber+) PHP Object Injection

The Countdown, Coming Soon, Maintenance – Countdown & Clock plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the conditionsRow and switchCountdown functions in all versions up to, and including, 2.7.8. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject PHP Objects and modify the status of countdowns.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Edmonsoft
Products
Countdown Builder
CVE-2024-1955

Hide Dashboard Notifications <= 1.3 - Missing Authorization to Authenticated(Contributor+) Plugin Settings Modification

The Hide Dashboard Notifications plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'warning_notices_settings' function in all versions up to, and including, 1.3. This makes it possible for authenticated attackers, with contributor access and above, to modify the plugin's settings.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wprepublic
Products
Hide Dashboard Notifications
CVE-2024-1937

Brizy – Page Builder <= 2.4.44 - Missing Authorization to Authenticated (Contributor+) Post Modification

The Brizy – Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_item' function in all versions up to, and including, 2.4.44. This makes it possible for authenticated attackers, with contributor access and above, to modify the content of arbitrary published posts, which includes the ability to insert malicious JavaScript.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Brizy
Products
Brizy
CVE-2024-1861

Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan <= 4.52 - Missing Authorization to Authenticated (Subscriber+) Table Truncation

The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the antihacker_truncate_scan_table() function in all versions up to, and including, 4.52. This makes it possible for authenticated attackers, with subscriber-level access and above, to truncate the scan table.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Billminozzi
Products
Anti Hacker
CVE-2024-1851

affiliate-toolkit – WordPress Affiliate Plugin <= 3.5.4 - Missing Authorization via atkp_create_list

The affiliate-toolkit – WordPress Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the atkp_create_list() function in all versions up to, and including, 3.5.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to to perform unauthorized actions such as creating product lists.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Servit
Products
Affiliate-toolkit
CVE-2024-1778

Admin side data storage for Contact Form 7 <= 1.1.1 - Missing Authorization to Unauthenticated Bookmark Status Alteration

The Admin side data storage for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the zt_dcfcf_change_bookmark() function in all versions up to, and including, 1.1.1. This makes it possible for unauthenticated attackers to alter bookmark statuses.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Zestard
Products
Admin Side Data Storage For Contact Form 7
CVE-2024-1652

Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxClearCategory

The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxClearCategory function in all versions up to, and including, 1.0.7.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to clear categories.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Frenify
Products
Categorify
CVE-2024-1650

Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxRenameCategory

The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxRenameCategory function in all versions up to, and including, 1.0.7.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to rename categories.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Frenify
Products
Categorify
CVE-2024-1649

Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxDeleteCategory

The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxDeleteCategory function in all versions up to, and including, 1.0.7.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete categories.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Frenify
Products
Categorify
CVE-2024-1587

Newsmatic <= 1.3.4 - Unauthenticated Information Exposure via newsmatic_filter_posts_load_tab_content

The Newsmatic theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.0 via the 'newsmatic_filter_posts_load_tab_content'. This makes it possible for unauthenticated attackers to view draft posts and post content.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Blazethemes
Products
Newsmatic
CVE-2024-1562

WooCommerce Google Sheet Connector <= 1.3.11 - Missing Authorization

The WooCommerce Google Sheet Connector plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the execute_post_data function in all versions up to, and including, 1.3.11. This makes it possible for unauthenticated attackers to update plugin settings.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gsheetconnector
Products
Woocommerce Google Sheet Connector
CVE-2024-1516

WP eCommerce <= 3.15.1 - Missing Authorization to Unauthenticated Arbitrary Post Creation

The WP eCommerce plugin for WordPress is vulnerable to unauthorized arbitrary post creation due to a missing capability check on the check_for_saas_push() function in all versions up to, and including, 3.15.1. This makes it possible for unauthenticated attackers to create arbitrary posts with arbitrary content.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wp-ecommerce Zao
Products
Wp-e-commerce Wp Ecommerce
CVE-2024-1389

Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.11.1 - Missing Authorization via pms_stripe_connect_handle_authorization_return

The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pms_stripe_connect_handle_authorization_return function in all versions up to, and including, 2.11.1. This makes it possible for unauthenticated attackers to change the Stripe payment keys.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Cozmoslabs Iovamihai
Products
Membership \& Content Restriction - Paid Member Subscriptions Paid Membership Subscriptions Effortless Memberships Recurring Payments And Content Restriction
CVE-2024-1388

Yuki <= 1.3.13 - Missing Authorization to Authenticated (Subscriber+) Theme Setting Reset

The Yuki theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the reset_customizer_options() function in all versions up to, and including, 1.3.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to reset the theme's settings.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wpmoose
Products
Yuki
CVE-2024-1387

Happy Addons for Elementor <= 3.10.4 - Incorrect Authorization to Information Exposure

The Happy Addons for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to insufficient authorization on the duplicate_thing() function in all versions up to, and including, 3.10.4. This makes it possible for attackers, with contributor-level access and above, to clone arbitrary posts (including private and password protected ones) which may lead to information exposure.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Leevio
Products
Happy Addons For Elementor
CVE-2024-1368

Page Duplicator <= 0.1.1 - Missing Authorization to Unauthenticated Post/Page Duplication

The Page Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplicate_dat_page() function in all versions up to, and including, 0.1.1. This makes it possible for unauthenticated attackers to duplicate arbitrary posts and pages.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Samuelkwle
Products
Page Duplicator
CVE-2024-1352

Classified Listing – Classified ads & Business Directory Plugin <= 3.0.4 - Missing Authorization

The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized access & modification of data due to a missing capability check on the rtcl_import_location() rtcl_import_category() functions in all versions up to, and including, 3.0.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to create terms.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Radiustheme Techlabpro1
Products
Classified Listing Classified Listing Plugin
CVE-2024-1322

Directorist <= 7.8.4 - Missing Authorization to Unauthenticated Settings Change

The Directorist – WordPress Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'setup_wizard' function in all versions up to, and including, 7.8.4. This makes it possible for unauthenticated attackers to recreate default pages and enable or disable monetization and change map provider.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wpwax
Products
Directorist