CVE-2024-43122

WordPress Robin image optimizer plugin <= 1.6.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in Creative Motion Robin image optimizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Robin image optimizer: from n/a through 1.6.9.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2024-43134

WordPress Waitlist Woocommerce plugin <= 2.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in xootix Waitlist Woocommerce ( Back in stock notifier ) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Waitlist Woocommerce ( Back in stock notifier ): from n/a through 2.6.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2024-43143

WordPress Registrations for the Events Calendar plugin <= 2.12.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Roundup WP Registrations for the Events Calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Registrations for the Events Calendar: from n/a through 2.12.1.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2024-43146

WordPress Accelerated Mobile Pages plugin <= 1.0.96.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Ahmed Kaludi, Mohammed Kaludi AMP for WP allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AMP for WP: from n/a through 1.0.96.1.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2024-43154

WordPress Advanced Cron Manager – debug & control plugin <= 2.5.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in BracketSpace Advanced Cron Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Cron Manager – debug & control: from n/a through 2.5.9.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bracketspace Wordpress

Products

Advanced Cron Manager Wordpress

CVE-2024-43157

WordPress FormCraft plugin <= 1.2.10 - Broken Access Control vulnerability

Missing Authorization vulnerability in nCrafts FormCraft allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FormCraft: from n/a through 1.2.10.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ncrafts Wordpress

Products

Formcraft Wordpress

CVE-2024-43209

WordPress Bitly's WordPress Plugin plugin <= 2.7.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Bitly allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Bitly: from n/a through 2.7.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Bitly

Products

Bitly

CVE-2024-4319

Advanced Contact form 7 DB <= 2.0.2 - Missing Authorization to Unauthenticated Information Disclosure

The Advanced Contact form 7 DB plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'vsz_cf7_export_to_excel' function in versions up to, and including, 2.0.2. This makes it possible for unauthenticated attackers to download the entry data for submitted forms.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2024-43212

WordPress WpTravelly plugin <= 1.7.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in MagePeople Team WpTravelly allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WpTravelly: from n/a through 1.7.7.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Magepeople

Products

Wptravelly

CVE-2024-43215

WordPress Social Slider Feed plugin <= 2.2.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in creativemotion Social Slider Feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Social Slider Feed: from n/a through 2.2.2.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2024-43219

WordPress Persian WooCommerce plugin <= 7.1.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in ووکامرس فارسی Persian WooCommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Persian WooCommerce: from n/a through 7.1.6.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Woocommerce

Products

Persian-woocommerce

CVE-2024-43235

WordPress Meta Box plugin <= 5.9.10 - Broken Access Control vulnerability

Missing Authorization vulnerability in MetaBox.Io Meta Box – WordPress Custom Fields Framework allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.9.10.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2024-43247

WordPress WHMpress plugin <= 6.2-revision-5 - Subscriber+ Arbitrary Settings Change vulnerability

Missing Authorization vulnerability in creativeon WHMpress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WHMpress: from n/a through 6.2-revision-5.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Creativeon

Products

Whmpress

CVE-2024-43256

WordPress Leopard plugin <= 2.0.36 - Subscriber+ Plugin Settings Change vulnerability

Missing Authorization vulnerability in nouthemes Leopard - WordPress offload media allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Leopard - WordPress offload media: from n/a through 2.0.36.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2024-43260

WordPress Clearfy Cache plugin <= 2.2.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in Creative Motion Clearfy Cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clearfy Cache: from n/a through 2.2.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress

Products

Wordpress

CVE-2024-43268

WordPress Backup and Restore WordPress plugin <= 1.50 - Broken Access Control vulnerability

Access Control vulnerability in WPBackItUp Backup and Restore WordPress allows . This issue affects Backup and Restore WordPress: from n/a through 1.50.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Wpbackitup

Products

Wordpress Backup And Restore Wordpress

CVE-2024-43270

WordPress Backup and Restore WordPress plugin <= 1.50 - Unauthenticated Broken Access Control vulnerability

Missing Authorization vulnerability in WPBackItUp Backup and Restore WordPress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Backup and Restore WordPress: from n/a through 1.50.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wpbackitup

Products

Wp Backitup

CVE-2024-43273

WordPress Icegram Collect plugin <= 1.3.14 - Broken Access Control vulnerability

Missing Authorization vulnerability in icegram Icegram Collect plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Icegram Collect plugin: from n/a through 1.3.14.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Icegram

Products

Icegram Collect

CVE-2024-43277

WordPress UsersWP plugin <= 1.2.15 - Broken Access Control vulnerability

Missing Authorization vulnerability in AyeCode Ltd UsersWP allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through 1.2.15.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ayecode

Products

Userswp

CVE-2024-45050

Ringer Server Does Not Check Members When Loading Messages

Ringer server is the server code for the Ringer messaging app. Prior to version 1.3.1, there is an issue with the messages loading route where Ringer Server does not check to ensure that the user loading the conversation is actually a member of that conversation. This allows any user with a Lif Account to load any conversation between two users without permission. This issue had been patched in version 1.3.1. There is no action required for users. Lif Platforms will update their servers with the patch.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—