Export limit exceeded: 425822 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2025-66125

WordPress Ultimate Auction plugin <= 4.3.3 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Nitesh Ultimate Auction ultimate-auction allows Retrieve Embedded Sensitive Data.This issue affects Ultimate Auction : from n/a through <= 4.3.3.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Nitesh Singh Wordpress
Products
Ultimate Wordpress Auction Plugin Wordpress
CVE-2025-68084

WordPress Ultimate Auction plugin <= 4.3.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Nitesh Ultimate Auction ultimate-auction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Auction : from n/a through <= 4.3.3.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Nitesh Singh Wordpress
Products
Ultimate Wordpress Auction Plugin Wordpress
CVE-2025-0958

Ultimate WordPress Auction Plugin <= 4.2.9 - Missing Authorization to Arbitrary Post Deletion

The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to unauthorized access to functionality in all versions up to, and including, 4.2.9. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary auctions, posts as well as pages and allows them to execute other actions related to auction handling.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Auctionplugin Nitesh Singh Wordpress
Products
Ultimate Auction Ultimate Wordpress Auction Plugin Wordpress
CVE-2024-6591

Ultimate WordPress Auction Plugin <= 4.2.7 - Missing Authorization to Unauthenticated Email Creation

The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to unauthorized email creation and sending due to a missing capability check on the 'send_auction_email_callback' and 'resend_auction_email_callback' functions in all versions up to, and including, 4.2.7. This makes it possible for unauthenticated attackers to craft emails that include links and send to any email address.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Nitesh Singh
Products
Ultimate Wordpress Auction Plugin