Export limit exceeded: 12017 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 12,017

Export CSV
CVE-2024-0907

NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via restore_records()

The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the restore_records() function in all versions up to, and including, 8.5.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to restore records.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Basixonline
Products
Nex-forms
CVE-2024-0893

Schema App Structured Data <= 2.2.0 - Missing Authorization

The Schema App Structured Data plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the MarkupUpdate function in all versions up to, and including, 2.2.0. This makes it possible for authenticated attackers, with subscriber access or higher, to update or delete post metadata.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hunch Manifest Schemaapp
Products
Schema App Structured Data Schema App Structured Data
CVE-2024-0869

Instant Images <= 6.1.0 - Authenticated (Author+) Arbitrary Options Update

The Instant Images – One Click Image Uploads from Unsplash, Openverse, Pixabay and Pexels plugin for WordPress is vulnerable to unauthorized arbitrary options update due to an insufficient check that neglects to verify whether the updated option belongs to the plugin on the instant-images/license REST API endpoint in all versions up to, and including, 6.1.0. This makes it possible for authors and higher to update arbitrary options. CVE-2024-33569 appears to be a duplicate of this issue.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Connekthq
Products
Instant Images - One Click Unsplash Uploads
CVE-2024-0797

Active Products Tables for WooCommerce. Professional products tables for WooCommerce store <= 1.0.6.1 - Missing Authorization

The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on several functions in all versions up to, and including, 1.0.6.1. This makes it possible for subscribers and higher to execute functions intended for admin use.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Pluginus
Products
Woot
CVE-2024-0791

WOLF – WordPress Posts Bulk Editor and Manager Professional <= 1.0.8.1 - Missing Authorization

The WOLF – WordPress Posts Bulk Editor and Manager Professional plugin for WordPress is vulnerable to unauthorized access, modification or loss of data due to a missing capability check on the wpbe_create_new_term, wpbe_update_tax_term, and wpbe_delete_tax_term functions in all versions up to, and including, 1.0.8.1. This makes it possible for authenticated attackers, with subscriber access or higher, to create, delete or modify taxonomy terms.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Pluginus
Products
Wolf - Wordpress Posts Bulk Editor And Products Manager Professional
CVE-2024-0593

Simple Job Board <= 2.10.8 - Missing Authorization to Unauthenticated Information Disclosure

The Simple Job Board plugin for WordPress is vulnerable to unauthorized access of data| due to insufficient authorization checking on the fetch_quick_job() function in all versions up to, and including, 2.10.8. This makes it possible for unauthenticated attackers to fetch arbitrary posts, which can be password protected or private and contain sensitive information.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Presstigers
Products
Simple Job Board
CVE-2024-0451

AI ChatBot <= 5.3.4 - Missing Authorization via openai_file_list_callback

The AI ChatBot plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the openai_file_list_callback function in all versions up to, and including, 5.3.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to list files existing in a linked OpenAI account.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Quantumcloud
Products
Wpbot
CVE-2024-0385

Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxAddCategory

The Categorify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the categorifyAjaxAddCategory function in all versions up to, and including, 1.0.7.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to add categories.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Frenify
Products
Categorify
CVE-2024-0372

Views for WPForms <= 3.2.2 - Missing Authorization via get_form_fields

The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_form_fields' function in all versions up to, and including, 3.2.2. This makes it possible for authenticated attackers, with subscriber access and above, to create form views.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Formviewswp
Products
Views For Wpforms
CVE-2024-0324

User Profile Builder <= 3.10.8 - Missing Authorization to Plugin Settings Change via wppb_two_factor_authentication_settings_update

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wppb_two_factor_authentication_settings_update' function in all versions up to, and including, 3.10.8. This makes it possible for unauthenticated attackers to enable or disable the 2FA functionality present in the Premium version of the plugin for arbitrary user roles.

CVSS 3.1 · 8.2 High EPSS 2.4% KEV · Not listed
Vendors
Cozmoslabs
Products
Profile Builder
CVE-2023-6985

10Web AI Assistant – AI content writing assistant <= 1.0.18 - Missing Authorization to Arbitrary Plugin Installation

The 10Web AI Assistant – AI content writing assistant plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the install_plugin AJAX action in all versions up to, and including, 1.0.18. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins that can be used to gain further access to a compromised site.

CVSS 3.1 · 6.5 Medium EPSS 1.4% KEV · Not listed
Vendors
10web
Products
Ai Assistant
CVE-2023-6496

Manage Notification E-mails <= 1.8.5 - Missing Authorization

The Manage Notification E-mails plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.8.5 via the card_famne_export_settings function. This makes it possible for unauthenticated attackers to obtain plugin settings.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Freeamigos
Products
Manage Notification E-mails
CVE-2023-6327

ShopLentor (formerly WooLentor) <= 2.8.7 - Missing Authorization via purchased_new_products

The ShopLentor (formerly WooLentor) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the purchased_new_products function in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to view all products purchased in the past week, along with the users that purchased them.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Hasthemes Wordpress
Products
Shoplentor Wordpress
CVE-2023-6158

EventON - WordPress Virtual Event Calendar Plugin Pro <= 4.5.4 & Free <= 2.2.7 - Missing Authorization to Arbitrary Post Meta Update via evo_eventpost_update_meta

The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the evo_eventpost_update_meta function in all versions up to, and including, 4.5.4 (for Pro) and 2.2.7 (for free). This makes it possible for unauthenticated attackers to update and remove arbitrary post metadata. Note that certain parameters may allow for content injection. CVE-2024-0238 appears to be a duplicate of this issue.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Myeventon
Products
Eventon Eventon-lite
CVE-2023-5711

System Dashboard <= 2.8.8 - Missing Authorization to Information Disclosure (sd_php_info)

The System Dashboard plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the sd_php_info() function hooked via an AJAX action in all versions up to, and including, 2.8.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve sensitive information provided by PHP info.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Bowo
Products
System Dashboard
CVE-2023-5417

Funnelforms Free <= 3.4 - Missing Authorization to Category Update

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_update_category function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to modify the Funnelforms category for a given post ID.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Funnelforms
Products
Funnelforms
CVE-2023-4947

WooCommerce EAN Payment Gateway < 6.1.0 - Missing Authorization to Authenticated (Contributor+) EAN Update

The WooCommerce EAN Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the refresh_order_ean_data AJAX action in versions up to 6.1.0. This makes it possible for authenticated attackers with contributor-level access and above, to update EAN numbers for orders.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Yanco
Products
Woocommerce Ean Payment Gateway
CVE-2023-4943

BEAR <= 1.1.3.3 - Missing Authorization to Product Manipulation

The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe_bulkoperations_visibility function. This makes it possible for authenticated attackers (subscriber or higher) to manipulate products.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Pluginus
Products
Bear - Woocommerce Bulk Editor And Products Manager Professional
CVE-2023-4686

WP Customer Reviews <= 3.6.6 - Authenticated (Subscriber+) Sensitive Information Exposure

The WP Customer Reviews plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.6.6 via the ajax_enabled_posts function. This can allow authenticated attackers to extract sensitive data such as post titles and slugs, including those of protected and trashed posts and pages in addition to other post types such as galleries.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Bompus Gowebsolutions
Products
Wp Customer Reviews Wp Customer Reviews
CVE-2023-4374

WP Remote Users Sync <= 1.2.11 - Missing Authorization to Authenticated (Subscriber+) Log View

The WP Remote Users Sync plugin for WordPress is vulnerable to unauthorized access of data and addition of data due to a missing capability check on the 'refresh_logs_async' functions in versions up to, and including, 1.2.11. This makes it possible for authenticated attackers with subscriber privileges or above, to view logs.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Froger
Products
Wp Remote Users Sync