CVE-2024-38719

WordPress Auto Featured Image plugin <= 4.1.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Creative Motion Auto Featured Image (Auto Post Thumbnail) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Auto Featured Image (Auto Post Thumbnail): from n/a through 4.1.2.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2024-6579

Web and WooCommerce Addons for WPBakery Builder <= 1.4.5 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification

The Web and WooCommerce Addons for WPBakery Builder plugin for WordPress is vulnerable to unauthorized plugin settings modification due to a missing capability check on several plugin functions in all versions up to, and including, 1.4.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change some of the plugin settings.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2024-6591

Ultimate WordPress Auction Plugin <= 4.2.7 - Missing Authorization to Unauthenticated Email Creation

The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to unauthorized email creation and sending due to a missing capability check on the 'send_auction_email_callback' and 'resend_auction_email_callback' functions in all versions up to, and including, 4.2.7. This makes it possible for unauthenticated attackers to craft emails that include links and send to any email address.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Nitesh Singh

Products

Ultimate Wordpress Auction Plugin

CVE-2024-6599

Meks Video Importer <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) API Keys Modification

The Meks Video Importer plugin for WordPress is vulnerable to unauthorized API key modification due to a missing capability check on the ajax_save_settings function in all versions up to, and including, 1.0.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify the plugin's API keys. CVE-2024-38733 may be a duplicate of this issue.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mekshq Wordpress

Products

Meks Video Importer Wordpress

CVE-2024-6688

Oxygen Builder <= 4.8.3 - Missing Authorization to Authenticated (Subscriber+) Stylesheet Update

The Oxygen Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the oxy_save_css_from_admin AJAX action in all versions up to, and including, 4.8.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update stylesheets.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2024-38702

WordPress Product Delivery Date for WooCommerce – Lite plugin <= 2.7.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Tyche Softwares Product Delivery Date for WooCommerce – Lite allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Product Delivery Date for WooCommerce – Lite: from n/a through 2.7.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Tychesoftwares

Products

Product Delivery Date For Woocommerce Lite

CVE-2024-38699

WordPress Wallet System for WooCommerce plugin <= 2.5.13 - Sensitive Data Exposure via Exported File vulnerability

Missing Authorization vulnerability in WP Swings Wallet System for WooCommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Wallet System for WooCommerce: from n/a through 2.5.13.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Wpswings

Products

Wallet System For Woocommerce

CVE-2024-7621

Visual Website Collaboration, Feedback & Project Management – Atarim <= 4.0.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update

The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the process_wpfeedback_misc_options() function in all versions up to, and including, 4.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugins settings which can also be leveraged to gain access to the plugin's settings.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wpfeedback

Products

Visual Website Collaboration

CVE-2024-38695

WordPress WP GoToWebinar plugin <= 15.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in Martin Gibson WP GoToWebinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP GoToWebinar: from n/a through 15.6.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2024-7648

Opal Membership <= 1.2.4 - Authenticated (Subscriber+) Information Disclosure

The Opal Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.4 via the private notes functionality on payments which utilizes WordPress comments. This makes it possible for authenticated attackers, with subscriber-level access and above, to view private notes via recent comments that should be restricted to just administrators.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2024-38690

WordPress iPanorama 360 plugin <= 1.8.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Avirtum iPanorama 360 WordPress Virtual Tour Builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects iPanorama 360 WordPress Virtual Tour Builder: from n/a through 1.8.3.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ipanorama 360 Wordpress Virtual Tour Builder Project

Products

Ipanorama 360 Wordpress Virtual Tour Builder

CVE-2024-3821

wpDataTables - Tables & Table Charts (Premium) <= 6.3.2 - Missing Authorization to DataTable Access & Modification

The wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the wdt_ajax_actions.php file in all versions up to, and including, 6.3.2. This makes it possible for unauthenticated attackers to manipulate data tables. Please note this only affects the premium version of the plugin.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2024-7894

If Menu <= 0.19.1 - Missing Authorization to License Key Update

The If Menu plugin for WordPress is vulnerable to unauthorized modification of the plugin's license key due to a missing capability check on the 'actions' function in versions up to, and including, 0.19.1. This makes it possible for unauthenticated attackers to modify delete or modify the license key.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Andreiigna

Products

If Menu

CVE-2022-43476

WordPress Subscribe to Category Plugin <= 2.7.4 is vulnerable to Broken Access Control

Missing Authorization vulnerability in Daniel Söderström / Sidney van de Stouwe Subscribe to Category allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Subscribe to Category: from n/a through 2.7.4.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2024-8667

HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce <= 2.10.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Publication

The HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized post publication due to a missing capability check on the activateCampaign() function in all versions up to, and including, 2.10.0. This makes it possible for authenticated attackers, with contributor-level access and above, to publish arbitrary posts like ones they have submitted for review, or a site administrator has in draft.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2024-8675

Soumettre.fr <= 2.1.3 - Missing Authorization

The Soumettre.fr plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the soumettre_disconnect_gateway function in all versions up to, and including, 2.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disconnect the gateway and delete the API key.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2024-8682

JNews - WordPress Newspaper Magazine Blog AMP Theme <= 11.6.6 - Unauthorized User Registration

The JNews - WordPress Newspaper Magazine Blog AMP Theme theme for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 11.6.6. This is due to the plugin not properly validate if the user can register option is enabled prior to creating a user though the register_handler() function. This makes it possible for unauthenticated attackers to register as a user even when user registration is disabled.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2024-8860

Tourfic <= 2.14.5 - Missing Authorization in Multiple Functions

The Tourfic plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tf_order_status_email_resend_function, tf_visitor_details_edit_function, tf_checkinout_details_edit_function, tf_order_status_edit_function, tf_order_bulk_action_edit_function, tf_remove_room_order_ids, and tf_delete_old_review_fields functions in all versions up to, and including, 2.14.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to resend order status emails, update visitor/order details, edit check-in/out details, edit order status, perform bulk order status updates, remove room order IDs, and delete old review fields, respectively.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Themefic Wordpress

Products

Tourfic Wordpress

CVE-2024-34804

WordPress Tagembed plugin <= 5.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in Tagembed.This issue affects Tagembed: from n/a through 5.8.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2024-37935

WordPress Woocommerce OpenPos plugin <= 6.4.4 - Unauthenticated Sensitive Data Exposure vulnerability

Missing Authorization vulnerability in anhvnit Woocommerce OpenPos allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Woocommerce OpenPos: from n/a through 6.4.4.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Anhvnit

Products

Woocommerce Openpos