CVE-2023-6731

WP Show Posts <= 1.1.5 - Improper Authorization to Information Exposure

The WP Show Posts plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple AJAX functions in all versions up to, and including, 1.1.5. This makes it possible for authenticated attackers, with subscriber access and above, to view arbitrary post metadata, list posts, and view terms and taxonomies.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Generatepress

Products

Wp Show Posts

CVE-2023-6638

GTG Product Feed for Shopping <= 1.2.4 - Missing Authorization to Unauthenticated Plugin Settings Update

The GTG Product Feed for Shopping plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_settings' function in versions up to, and including, 1.2.4. This makes it possible for unauthenticated attackers to update plugin settings.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Gutengeek

Products

Gg Woo Feed

CVE-2023-6598

SpeedyCache <= 1.1.3 - Missing Authorization to Plugin Options Update

The SpeedyCache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the speedycache_save_varniship, speedycache_img_update_settings, speedycache_preloading_add_settings, and speedycache_preloading_delete_resource functions in all versions up to, and including, 1.1.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to update plugin options.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Softaculous

Products

Speedycache

CVE-2023-6557

The Events Calendar <= 6.2.8.2 - Unauthenticated Sensitive Information Exposure

The The Events Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.2.8.2 via the route function hooked into wp_ajax_nopriv_tribe_dropdown. This makes it possible for unauthenticated attackers to extract potentially sensitive data including post titles and IDs of pending, private and draft posts.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Stellarwp

Products

The Events Calendar

CVE-2023-6504

Profile Builder <= 3.10.7 - Insecure Direct Object Reference to Sensitive Information Exposure via user_meta Shortcode

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wppb_toolbox_usermeta_handler function in all versions up to, and including, 3.10.7. This makes it possible for authenticated attackers, with contributor-level access and above, to expose sensitive information within user metadata.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Cozmoslabs

Products

Profile Builder

CVE-2023-6491

Strong Testimonials <= 3.1.12 - Authenticated(Contributor+) Improper Authorization to Views Modification

The Strong Testimonials plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the wpmtst_save_view_sticky function in all versions up to, and including, 3.1.12. This makes it possible for authenticated attackers, with contributor access and above, to modify favorite views.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wpchill

Products

Strong Testimonials

CVE-2023-5713

System Dashboard <= 2.8.7 - Missing Authorization to Information Disclosure (sd_option_value)

The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_option_value() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve potentially sensitive option values, and deserialize the content of those values.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bowo

Products

System Dashboard

CVE-2023-5710

System Dashboard <= 2.8.7 - Missing Authorization to Information Disclosure (sd_constants)

The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_constants() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve sensitive information such as database credentials.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bowo

Products

System Dashboard

CVE-2023-5533

AI ChatBot <= 4.8.9 and 4.9.2 - Missing Authorization on AJAX actions

The AI ChatBot plugin for WordPress is vulnerable to unauthorized use of AJAX actions due to missing capability checks on the corresponding functions in versions up to, and including, 4.8.9 as well as 4.9.2. This makes it possible for unauthenticated attackers to perform some of those actions that were intended for higher privileged users.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Quantumcloud

Products

Wpbot

CVE-2023-5426

Post Meta Data Manager <=1.2.0 - Missing Authorization to User, Term, and Post Meta Deletion

The Post Meta Data Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmdm_wp_delete_user_meta, pmdm_wp_delete_term_meta, and pmdm_wp_ajax_delete_meta functions in versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to delete user, term, and post meta belonging to arbitrary users.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wpexpertplugins

Products

Post Meta Data Manager

CVE-2023-5425

Post Meta Data Manager <=1.2.0 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

The Post Meta Data Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmdm_wp_change_user_meta and pmdm_wp_change_post_meta functions in versions up to, and including, 1.2.0. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to gain elevated (e.g., administrator) privileges.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Wpexpertplugins

Products

Post Meta Data Manager

CVE-2023-5387

Funnelforms Free <= 3.4 - Missing Authorization to Enable/Disable Dark Mode

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_trigger_dark_mode function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to enable or disable the dark mode plugin setting.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Funnelforms

Products

Funnelforms

CVE-2023-5385

Funnelforms Free <= 3.4 - Missing Authorization to Arbitrary Post Duplication

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_copy_posts function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to create copies of arbitrary posts.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Funnelforms

Products

Funnelforms

CVE-2023-5251

Grid Plus <= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) Grid Layout Add/Update/Delete

The Grid Plus plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'grid_plus_save_layout_callback' and 'grid_plus_delete_callback' functions in versions up to, and including, 1.3.2. This makes it possible for authenticated attackers with subscriber privileges or above, to add, update or delete grid layout. CVE-2023-34014 appears to be a duplicate of this issue.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

G5theme

Products

Grid Plus

CVE-2023-5132

Soisy Pagamento Rateale <= 6.0.1 - Missing Authorization to Sensitive Information Exposure

The Soisy Pagamento Rateale plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the parseRemoteRequest function in versions up to, and including, 6.0.1. This makes it possible for unauthenticated attackers with knowledge of an existing WooCommerce Order ID to expose sensitive WooCommerce order information (e.g., Name, Address, Email Address, and other order metadata).

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Soisy

Products

Soisy Pagamento Rateale

CVE-2023-5054

Super Store Finder <= 6.9.3 - Unauthenticated Email Creation/Sending

The Super Store Finder plugin for WordPress is vulnerable to unauthenticated arbitrary email creation and relay in versions up to, and including, 6.9.3. This is due to insufficient restrictions on the sendMail.php file that allows direct access. This makes it possible for unauthenticated attackers to send emails utilizing the vulnerable site's server, with arbitrary content. Please note that this vulnerability has already been publicly disclosed with an exploit which is why we are publishing the details without a patch available, we are attempting to initiate contact with the developer.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Superstorefinder

Products

Super Store Finder

CVE-2023-4948

WooCommerce CVR Payment Gateway < 6.1.0 - Missing Authorization to Authenticated (Contributor+) CVR Update

The WooCommerce CVR Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the refresh_order_cvr_data AJAX action in versions up to 6.1.0. This makes it possible for authenticated attackers with contributor-level access and above, to update CVR numbers for orders.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Yanco

Products

Woocommerce Cvr Payment Gateway

CVE-2023-4941

BEAR <= 1.1.3.3 - Missing Authorization to Product Manipulation

The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe_bulkoperations_swap function. This makes it possible for authenticated attackers (subscriber or higher) to manipulate products.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Pluginus

Products

Bear - Woocommerce Bulk Editor And Products Manager Professional

CVE-2023-4938

BEAR <= 1.1.3.3 - Missing Authorization to Product Manipulation

The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe_bulkoperations_apply_default_combination function. This makes it possible for authenticated attackers (subscriber or higher) to manipulate products.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Pluginus

Products

Bear - Woocommerce Bulk Editor And Products Manager Professional

CVE-2023-4792

Duplicate Post Page Menu & Custom Post Type <= 2.3.1 - Missing Authorization to Post Duplication

The Duplicate Post Page Menu & Custom Post Type plugin for WordPress is vulnerable to unauthorized page and post duplication due to a missing capability check on the duplicate_ppmc_post_as_draft function in versions up to, and including, 2.3.1. This makes it possible for authenticated attackers with subscriber access or higher to duplicate posts and pages.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Inqsys

Products

Duplicate Post Page Menu \& Custom Post Type