CVE-2019-25142

Mesmerize <= 1.6.89 & Materialis <= 1.0.172 - Authenticated Arbitrary Options Update

The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and including,1.6.89 (Mesmerize) and 1.0.172 (Materialis). This is due to 'companion_disable_popup' function only checking the nonce while sending user input to the 'update_option' function. This makes it possible for authenticated attackers to change otherwise restricted options.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed

Vendors

Extendthemes

Products

Materialis Mesmerize

CVE-2019-25141

Easy WP SMTP <= 1.3.9 - Missing Authorization to Arbitrary Options Update

The Easy WP SMTP plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.3.9. This is due to missing capability checks on the admin_init() function, in addition to insufficient input validation. This makes it possible for unauthenticated attackers to modify the plugins settings and arbitrary options on the site that can be used to inject new administrative user accounts.

CVSS 3.1 · 9.8 Critical EPSS 4.5% KEV · Not listed

Vendors

Wp-ecommerce

Products

Easy Wp Smtp

CVE-2019-25139

Coming Soon Page & Maintenance Mode <= 1.8.1 - Unauthenticated Settings Reset

The Coming Soon Page & Maintenance Mode plugin for WordPress is vulnerable to unauthenticated settings reset in versions up to, and including 1.8.1 due to missing capability checks in the ~/functions/data-reset-post.php file which makes it possible for unauthenticated attackers to trigger a plugin settings reset.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wpshopmart

Products

Coming Soon Page \& Maintenance Mode

CVE-2024-7258

WooCommerce Google Feed Manager <= 2.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Deletion

The WooCommerce Google Feed Manager plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wppfm_removeFeedFile' function in all versions up to, and including, 2.8.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Wpmarketingrobot

Products

Woocommerce Google Feed Manager

CVE-2024-6155

Greenshift – animation and page builder blocks <= 9.0.0 - Missing Authorization to Authenticated (Subscriber+) Server-Side Request Forgery and Stored Cross-Site Scripting

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Authenticated (Subscriber+) Server-Side Request Forgery and Stored Cross Site Scripting in all versions up to, and including, 9.0.0 due to a missing capability check in the greenshift_download_file_localy function, along with no SSRF protection and sanitization on uploaded SVG files. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application that can also be leveraged to download malicious SVG files containing Cross-Site Scripting payloads to the server. On Cloud-based servers, attackers could retrieve the instance metadata. The issue was partially patched in version 8.9.9 and fully patched in version 9.0.1.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Greenshiftwp

Products

Greenshift - Animation And Page Builder Blocks

CVE-2024-6489

Getwid – Gutenberg Blocks <= 2.0.10 - Missing Authorization to Google API key update

The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the get_google_api_key function in all versions up to, and including, 2.0.10. This makes it possible for authenticated attackers, with Contributor-level access and above, to set the MailChimp API key.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Motopress

Products

Getwid

CVE-2024-7858

Media Library Folders <= 8.2.3 - Missing Authorization on Various Functions

The Media Library Folders plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several AJAX functions in the media-library-plus.php file in all versions up to, and including, 8.2.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform several actions related to managing media files and folder along with controlling settings.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Maxfoundry

Products

Media Library Folders

CVE-2023-7294

Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'create_mollie_profile'

The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the create_mollie_profile function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to create a mollie payment profile.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Paytium

Products

Paytium

CVE-2024-6491

Getwid – Gutenberg Blocks <= 2.0.10 - Missing Authentication to MailChimp API key update

The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the mailchimp_api_key_manage function in all versions up to, and including, 2.0.10. This makes it possible for authenticated attackers, with Contributor-level access and above, to set the MailChimp API key.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Motopress

Products

Getwid

CVE-2024-8771

Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure

The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'preview_email_template_design' function in all versions up to, and including, 5.7.34. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including the content of private, password protected, pending, and draft posts and pages.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Icegram

Products

Email Subscribers \& Newsletters

CVE-2024-9025

Sight – Professional Image Gallery and Portfolio <= 1.1.2 - Missing Authorization to Sensitive Information Exposure in handler_post_title

The Sight – Professional Image Gallery and Portfolio plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handler_post_title' function in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to expose private, pending, trashed, and draft post titles. Successful exploitation requires the Elementor plugin to be installed and activated.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Codesupply Codesupplyco

Products

Sight Sight Professional Image Gallery And Portfolio

CVE-2024-13783

FormCraft <= 3.9.11 - Missing Authorization to Plugin Data Export in formcraft-main.php

The FormCraft plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check in formcraft-main.php in all versions up to, and including, 3.9.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export all plugin data which may contain sensitive information from form submissions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ncrafts

Products

Formcraft

CVE-2024-10529

Kognetiks Chatbot for WordPress <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant Deletion

The Kognetiks Chatbot for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_assistant() function in all versions up to, and including, 2.1.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete GTP assistants.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Kognetiks

Products

Chatbot Kognetiks Chatbot

CVE-2024-8121

The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Missing Authorization to Admin Username Change

The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of user names due to a missing capability check on the wpext_change_admin_name() function in all versions up to, and including, 3.0.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change an admin's username to a username of their liking as long as the default 'admin' was used.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wpextended

Products

Wp Extended

CVE-2024-6631

ImageRecycle pdf & image compression <= 3.1.14 - Missing Authorization in Several AJAX Actions

The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions in all versions up to, and including, 3.1.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform unauthorized actions, such as updating plugin settings.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Imagerecycle

Products

Imagerecycle Pdf \& Image Compression

CVE-2024-11270

WordPress Webinar Plugin – WebinarPress <= 1.33.24 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Creation

The WordPress Webinar Plugin – WebinarPress plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check on the 'sync-import-imgs' function and missing file type validation in all versions up to, and including, 1.33.24. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary files that can lead to remote code execution.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Webinarpress

Products

Webinarpress

CVE-2024-12427

Multi Step Form <= 1.7.23 - Missing Authorization to Unauthenticated Limited File Upload

The Multi Step Form plugin for WordPress is vulnerable to unauthorized limited file upload due to a missing capability check on the fw_upload_file AJAX action in all versions up to, and including, 1.7.23. This makes it possible for unauthenticated attackers to upload limited file types such as images.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mondula

Products

Multi Step Form

CVE-2023-7293

Paytium: Mollie payment forms & donations <= 4.3.7 - Missing Authorization in 'check_mollie_account_details'

The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the check_mollie_account_details function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with subscriber-level access to verify the existence of a mollie account.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Paytium

Products

Paytium

CVE-2024-13656

Click Mag - Viral WordPress News Magazine/Blog Theme <= 3.6.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Deletion

The Click Mag - Viral WordPress News Magazine/Blog Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the propanel_of_ajax_callback() function in all versions up to, and including, 3.6.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mvpthemes

Products

Click Mag

CVE-2024-6626

EleForms – All In One Form Integration including DB for Elementor <= 2.9.9.9 - Missing Authorization

The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on several functions in all versions up to, and including, 2.9.9.9. This makes it possible for unauthenticated attackers to view form submissions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Theinnovs Thelnnovs

Products

Eleforms Eleforms