ByteOS Network

Vulnerability Details :

CVE-2021-4366

Assigner Org ID-b15e7b5b-3da4-40ae-a43c-f7aa60e62599

Published At-07 Jun, 2023 | 01:51

Updated At-20 Dec, 2024 | 23:51

The PWA for WP & AMP plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the pwaforwp_update_features_options function in versions up to, and including, 1.7.32. This makes it possible for authenticated attackers to change the otherwise restricted settings within the plugin.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:Wordfence

Assigner Org ID:b15e7b5b-3da4-40ae-a43c-f7aa60e62599

Published At:07 Jun, 2023 | 01:51

Updated At:20 Dec, 2024 | 23:51

▼CVE Numbering Authority (CNA)

Affected Products

Vendor

Mohammed & Ahmed Kaludi (Magazine3)

Product

PWA for WP & AMP

Default Status

unaffected

Versions

Affected

From * through 1.7.32 (semver)

Problem Types

Type	CWE ID	Description
N/A	N/A	CWE-862 Missing Authorization

Type: N/A

CWE ID: N/A

Description: CWE-862 Missing Authorization

Metrics

Version	Base score	Base severity	Vector
3.1	6.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Version: 3.1

Base score: 6.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Credits

finder

Jerome Bruandet

Timeline

Event	Date
Disclosed	2021-07-01 00:00:00

Event: Disclosed

Date: 2021-07-01 00:00:00

References

Hyperlink	Resource
https://www.wordfence.com/threat-intel/vulnerabilities/id/a9892dd1-3939-41a9-a828-fa1bf7d96eb8?source=cve	N/A
https://blog.nintechnet.com/wordpress-pwa-for-wp-and-amp-plugin-fixed-vulnerabilities/	N/A
https://wpscan.com/vulnerability/b38a51d7-375e-4cca-88ba-ccab796ac134	N/A

Hyperlink: https://www.wordfence.com/threat-intel/vulnerabilities/id/a9892dd1-3939-41a9-a828-fa1bf7d96eb8?source=cve

Resource: N/A

Hyperlink: https://blog.nintechnet.com/wordpress-pwa-for-wp-and-amp-plugin-fixed-vulnerabilities/

Resource: N/A

Hyperlink: https://wpscan.com/vulnerability/b38a51d7-375e-4cca-88ba-ccab796ac134

Resource: N/A

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://www.wordfence.com/threat-intel/vulnerabilities/id/a9892dd1-3939-41a9-a828-fa1bf7d96eb8?source=cve	x_transferred
https://blog.nintechnet.com/wordpress-pwa-for-wp-and-amp-plugin-fixed-vulnerabilities/	x_transferred
https://wpscan.com/vulnerability/b38a51d7-375e-4cca-88ba-ccab796ac134	x_transferred

Hyperlink: https://www.wordfence.com/threat-intel/vulnerabilities/id/a9892dd1-3939-41a9-a828-fa1bf7d96eb8?source=cve

Resource:

x_transferred

Hyperlink: https://blog.nintechnet.com/wordpress-pwa-for-wp-and-amp-plugin-fixed-vulnerabilities/

Resource:

x_transferred

Hyperlink: https://wpscan.com/vulnerability/b38a51d7-375e-4cca-88ba-ccab796ac134

Resource:

x_transferred

2. CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:security@wordfence.com

Published At:07 Jun, 2023 | 02:15

Updated At:07 Nov, 2023 | 03:40

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Secondary	3.1	6.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Type: Primary

Version: 3.1

Base score: 4.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Type: Secondary

Version: 3.1

Base score: 6.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CPE Matches

Mohammed & Ahmed Kaludi (Magazine3)

>>pwa_for_wp_\&_amp>>Versions before 1.7.33(exclusive)

cpe:2.3:a:magazine3:pwa_for_wp_\&_amp:*:*:*:*:*:wordpress:*:*

Weaknesses

CWE ID	Type	Source
CWE-862	Primary	nvd@nist.gov

CWE ID: CWE-862

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://blog.nintechnet.com/wordpress-pwa-for-wp-and-amp-plugin-fixed-vulnerabilities/	security@wordfence.com	Exploit Third Party Advisory
https://wpscan.com/vulnerability/b38a51d7-375e-4cca-88ba-ccab796ac134	security@wordfence.com	Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/a9892dd1-3939-41a9-a828-fa1bf7d96eb8?source=cve	security@wordfence.com	Third Party Advisory

Hyperlink: https://blog.nintechnet.com/wordpress-pwa-for-wp-and-amp-plugin-fixed-vulnerabilities/

Source: security@wordfence.com

Resource:

Exploit

Third Party Advisory

Hyperlink: https://wpscan.com/vulnerability/b38a51d7-375e-4cca-88ba-ccab796ac134

Source: security@wordfence.com

Resource:

Third Party Advisory

Hyperlink: https://www.wordfence.com/threat-intel/vulnerabilities/id/a9892dd1-3939-41a9-a828-fa1bf7d96eb8?source=cve

Source: security@wordfence.com

Resource:

Third Party Advisory

Similar CVEs

867Records found

CVE-2025-31781

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.03% / 6.86%

7 Day CHG-0.02%

Published-01 Apr, 2025 | 14:51

Updated-01 Apr, 2025 | 20:26

WordPress Gift Cards for WooCommerce plugin <= 1.5.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in ahmadshyk Gift Cards for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Gift Cards for WooCommerce: from n/a through 1.5.8.

Vendor-ahmadshyk

Product-Gift Cards for WooCommerce

CWE ID-CWE-862

Missing Authorization

CVE-2025-31417

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.03% / 6.86%

7 Day CHG-0.02%

Published-31 Mar, 2025 | 06:06

Updated-01 Apr, 2025 | 20:26

WordPress WP Docs plugin < 2.2.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in Fahad Mahmood WP Docs allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Docs: from n/a through n/a.

Vendor-Fahad Mahmood

Product-WP Docs

CWE ID-CWE-862

Missing Authorization

CVE-2025-30881

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.03% / 6.86%

7 Day CHG-0.00%

Published-27 Mar, 2025 | 10:55

Updated-27 Mar, 2025 | 18:57

WordPress Big Store theme <= 2.0.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in ThemeHunk Big Store allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Big Store: from n/a through 2.0.8.

Vendor-ThemeHunk

Product-Big Store

CWE ID-CWE-862

Missing Authorization

CVE-2025-31798

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.03% / 6.86%

7 Day CHG-0.02%

Published-01 Apr, 2025 | 14:51

Updated-02 Apr, 2025 | 15:18

WordPress Publitio Plugin <= 2.1.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in publitio Publitio allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Publitio: from n/a through 2.1.8.

Vendor-publitio

Product-Publitio

CWE ID-CWE-862

Missing Authorization

CVE-2025-31755

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.03% / 6.86%

7 Day CHG-0.02%

Published-01 Apr, 2025 | 14:51

Updated-01 Apr, 2025 | 20:36

WordPress pCloud Backup plugin <= 1.0.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in josselynj pCloud Backup allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects pCloud Backup: from n/a through 1.0.1.

Vendor-josselynj

Product-pCloud Backup

CWE ID-CWE-862

Missing Authorization

CVE-2025-30605

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.04% / 8.90%

7 Day CHG~0.00%

Published-24 Mar, 2025 | 13:47

Updated-24 Mar, 2025 | 15:40

WordPress sourceplay-navermap plugin <= 0.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in ldwin79 sourceplay-navermap allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects sourceplay-navermap: from n/a through 0.0.2.

Vendor-ldwin79

Product-sourceplay-navermap

CWE ID-CWE-862

Missing Authorization

CVE-2025-30543

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.03% / 6.86%

7 Day CHG~0.00%

Published-24 Mar, 2025 | 13:46

Updated-24 Mar, 2025 | 15:05

WordPress Menu Duplicator plugin <= 1.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in swayam.tejwani Menu Duplicator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Menu Duplicator: from n/a through 1.0.

Vendor-swayam.tejwani

Product-Menu Duplicator

CWE ID-CWE-862

Missing Authorization

CVE-2020-13276

Matching Score-4

Assigner-GitLab Inc.

View Details

Matching Score-4

Assigner-GitLab Inc.

CVSS Score-7.4||HIGH

EPSS-0.10% / 28.79%

7 Day CHG~0.00%

Published-19 Jun, 2020 | 21:37

Updated-04 Aug, 2024 | 12:11

User is allowed to set an email as a notification email even without verifying the new email in all previous GitLab CE/EE versions through 13.0.1

Vendor-GitLab Inc.

Product-gitlab GitLab

CWE ID-CWE-862

Missing Authorization

CVE-2025-28994

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.04% / 10.74%

7 Day CHG~0.00%

Published-06 Jun, 2025 | 12:54

Updated-06 Jun, 2025 | 15:02

WordPress Viral Loops WP Integration <= 3.8.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in viralloops Viral Loops WP Integration allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Viral Loops WP Integration: from n/a through 3.8.1.

Vendor-viralloops

Product-Viral Loops WP Integration

CWE ID-CWE-862

Missing Authorization

CVE-2023-41873

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.11% / 29.37%

7 Day CHG+0.01%

Published-13 Dec, 2024 | 14:24

Updated-16 Dec, 2024 | 17:51

WordPress SAML Single Sign On – SSO Login plugin <= 5.0.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in miniOrange SAML SP Single Sign On allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SAML SP Single Sign On: from n/a through 5.0.4.

Vendor-miniOrange

Product-SAML SP Single Sign On

CWE ID-CWE-862

Missing Authorization

CVE-2023-41865

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.10% / 27.60%

7 Day CHG+0.01%

Published-13 Dec, 2024 | 14:24

Updated-13 Dec, 2024 | 19:07

WordPress Slider Pro plugin <= 4.8.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in bqworks Slider Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Slider Pro: from n/a through 4.8.6.

Vendor-bqworks

Product-Slider Pro

CWE ID-CWE-862

Missing Authorization

CVE-2022-4974

Matching Score-4

Assigner-Wordfence

View Details

Matching Score-4

Assigner-Wordfence

CVSS Score-6.3||MEDIUM

EPSS-0.07% / 22.15%

7 Day CHG~0.00%

Published-16 Oct, 2024 | 06:43

Updated-16 Oct, 2024 | 18:06

Freemius SDK <= 2.4.2 - Missing Authorization Checks

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.

Vendor-wpscripts kokomoweb stylingwebben renaudbod edgegalleryplugin wpcohort pippozanardo pagebuildersandwich smusman98 muhammad-rehman sslzen tauhidpro fastaf/jetixwp danielealessandra pagup themesei dvizhenia wpconedev bavokoservices janthielemann skshaikat wpt00ls marviorocha bouncingsprout mberding cliffpaulick bfintal codeies milukove mdedev samuelsilvapt starfishwp tonyzeoli w3scloud pootlepress/fullworks wpbits linekal codexonics danish-ali lostboy7 benmoreassynt wpvibes daniyalahmedk olezhyk5 webmuehle darell xjohnyk lukeseager themesty streamweasels wphrmanager zerozendesign ivanchernyakov 9brada6 tobias_conrad/bestpluginswordpress badhonrocks pootlepress matthias-reuter tribalnerd alanfuller themeythemes wp-making tycoon12344 iksstudio rankbear spartac scrollsequence majick lkoudal ankitmaru wptb tobias_conrad josevega dangub86 moomooagency theafricanboss/attest imtiazrayhan maciejbak85 cebbi paulio21 ahmed17 galoover commercepundit webheadllc eedee ivan_paulin kitforest tickera khothemes chetmac modulemasters tprintyedisonave closemarketing/gowebsmarty marcqueralt chillichalli whiteshadow salttechno wptravelengine pmbaldha/sslatlas drosendo bradvin alphabposervice atakanoz litonice13 unitecms kaira shabti cleverplugins sjaved richard-b gloriousthemes powerfulwp stevehenty jkohlbach mohammedrezq peterschulznl princeahmed kitthemes munirkamal andyabelow samdani diviframework creativethemeshq versacomp gfirem dudo krsp sj_o aharonyan mvvapps/davidanderson oceanwp passionatebrains codesavory xplodedthemes livemesh sindyakinsergei mattpramschufer switcorp wpdelicious dgwyer giladtakoni clickervolt wpschoolcalendar protectyouruploads jburleigh1 rafalosinski johnc1979 anfrageformular closemarketing cypressnorth equalizedigital alleythemes woodyhayday oceas rebelcode popeating aguilerasoft elliotvs dam6pl ekanath milmor sonalsinha21 dipcode shelob9 svenl77 jurski cloudsponge maltathemes jwebsol pluginandplay wpcohort/pluginsware wgauge nplugins wppluginexperts upfiv damian-gora melapress codeatlantic wpeventpartners/wpexpertsio irkanu avidthemes/theafricanboss slidedeck weconnectcode appexpertsio blockspare wisersteps sakurapixel interfacelab meowcrew majick/ethereumicoio skyminds javmah nicheaddons alex-ye risetheme blockypage djenh wpsoul foxmoon mnelson4 ggriesser woopops gallerycreator mumarym1985 collizo4sky sovstack thinleek premmerce walkerwp syntactics gkher/wpgeniuz wpmagics svovaf webtechstreet patrickposner ggedde tranzly wpmunich tripetto takanakui essekia glowlogix mikebels intoxstudio mojofywp wpdevpowers nasirahmed oloyede-jamiu thecodechime dreamfox kylegilman mantrabrain infosatech mhmrajib hiddenpearls ultimateblocks plugins360 thijzie nitin247 infornweb toddhalfpenny mbrown24 cloudliving kkikuchi1220 zeetheme limbcode ultradevs proteusthemes fsruslan pmbaldha alexmoss ldninjas/vincoit actuaryzask bilaltas dovyp cmbibby/surbma kaizencoders dejanmarkovic multicollab mohsinoffline sebet wpeka-club alekv stevejburge patrickgarman janwyl cyberhobo arabianmido ivacy kaggdesign royalnavneet mcurly usmanaliqureshi jaydeep-nimavat bplugins vinod-dalvi seezee penguininitiatives beeneeb meeplugins wupo xyulex brandonfire dots shawoninfo boriscolombier/paretodigital vanyukov blockmeister kartikparmar/ejslondon/maurolopes/kartechify uriahs-victor ronena100 tropicalista getsparrow carlosmoreirapt vernal jcodex bycrik mte90 halmat deothemes wordpresschef divisumo frostbourn invisnet prasadkirpekar ninjalibs seancarrico annastaa jwind shamim51 staxwp mikewire_rocksolid maxsdesign kartikparmar mihail-barinov ibenic sebet/boltonstudios matstars therealwebdisrupt smartwpress themelocation kenanfallon greenjaymedia cromer12 bandido elementinvader wpchill 5starplugins milukove/cadudecastroalves h3technologies lynn999 webba-agency masterblocks wordplus sangaran co2ok pasyuk frenify dotrex prelc setka hqtheme jamesparkninja flexithemes daigo75 anssilaitila wpmoose buttonizer anasbinmukim listplus smgteam akdevs blackandwhitedigital snazzythemes wpengine elbisnero inputwp humblethemes wpdever rafacarvalhido jack-kitterhing wpjoli vohotv/Royal Elementor Addons BdThemes The Events Calendar (StellarWP)Themeisle

Product-Panorama Viewer- Best Plugin to Display Panoramic Images/Videos WooCommerce Variation Swatches for Products Easy Post Views Count Woocommerce Customer Reviews with Artificial Intelligence analyzis, with IBM Watson Tone Analyzer Ocean Extra CodeKit – Custom Codes Editor Form Vibes – Database Manager for Forms GFireM Advance Search STEWoo – Super Transactional Emails for WooCommerce BlockMeister – Block Pattern Builder WordPress Directory Plugin For Business Listings – WP Local Plus Airpress WP Sessions Time Monitoring Full Automatic Emails Blacklist for Everest Forms Smart Floating / Sticky Buttons – Call, Sharing, Chat Widgets & More – Buttonizer Expire tags XT Ajax Add To Cart for WooCommerce Before and After Product Images for WooCommerce Villar WP Search Filter Funnelmentals Frontend group restriction for LearnDash SEO Booster Team Members – A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More Pro Broken Links Maintainer Premmerce Product Filter for WooCommerce DancePress (TRWA)Walker Core BAVOKO SEO Tools – All-in-One WordPress SEO WP Security Safe jav's – WooCommerce and Trello integration WooTrello WP School Calendar Booking Addon for WooCommerce Station Pro Product Carousel For WooCommerce – WoorouSell CartPops – High Converting Add To Cart Popup For WooCommerce Giveaways for woocommerce BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages Greenshift – animation and page builder blocks Atlas – Knowledge Base WP Gratify Better Messages – Integration for WC Vendors Marketplace Blocksy Companion Qyrr – simply and modern QR-Code creation annasta Woocommerce Product Filters WP Tools Gravity Forms Divi Module Tablesome – Form DB & Automation – WPForms, Contact Form 7, Elementor, Forminator, Fluent, Gravity ClimateClick: Climate Action for all A no-code page builder for beautiful performance-based content Arendelle Market Exporter Connected Sermons Lightbox & Modal Popup WordPress Plugin – FooBox Starfish Review Generation & Marketing for WordPress WooCommerce Disable Payment Methods based on cart conditions Sticky add to cart for Woo Post Slider and Post Carousel with Post Vertical Scrolling Widget – A Responsive Post Slider Security Ninja – Secure Firewall & Secure Malware Scanner PopOverXYZ – Show Light Weight Beautiful Tool Tips On Any Text Easy Age Verify Notification Bar, Announcement and Cookie Notice WordPress Plugin – FooBar Premmerce Variation Swatches for WooCommerce Product Size Charts Plugin for WooCommerce Post Carousel Divi Age Verification Screen for WooCommerce Super Video Player- Best WordPress Video Display Plugin for mp4/OGG Simple Giveaways – Grow your business, email lists and traffic with contests HQTheme Extra Glossary Automizy Gravity Forms Extend Filter Products By Price Widget Order and Inventory Manager for WooCommerce Advanced Database Replacer Store Toolkit – WooCommerce Extensions, Quick Enhancements & Handy Tools Livemesh Addons for Beaver Builder Abeta Link PunchOut Master Blocks – Gutenberg Site Builder Premmerce Permalink Manager for WooCommerce Shipping Method Display Style for WooCommerce Spanish Market Enhancements for WooCommerce FeedbackScout: The easiest way to collect, prioritise, manage and track customer feedback.Restaurant & Cafe Addon for Elementor Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)WordPress Slider Block Gutenslider WP Lead Stream Aquarella Lite Really Simple Featured Video – Featured video support for Posts, Pages & WooCommerce Products VidSEO | WordPress Video SEO embedder with transcripts (Youtube & Vimeo)WPMailer – The best mail builder, No More Core for your emails support Elementor, CF7 forms etc…Multi Page Auto Advance for Gravity Forms TreePress – Easy Family Trees & Ancestor Profiles Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy)3D Viewer – 3D Model Viewer Plugin Purus Display Eventbrite Events Media Cloud for Bunny CDN, Amazon S3, Cloudflare R2, Google Cloud Storage, DigitalOcean and more APPExperts – Mobile App Builder for WordPress | WooCommerce to iOS and Android Apps WP Event Partners – WordPress Plugin for Event and Conference Management Floating Social Share Icons and Social Share buttons – Next Previous Post Links – FL Portfolio for Elementor & Image Gallery | PowerFolio Widgets for WooCommerce Products on Elementor StoreCustomizer – A plugin to Customize all WooCommerce Pages Email Tracker – Email Tracking Plugin to track Emails for Open and Email Links Click (Compatible with WooCommerce)Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider)Custom WooCommerce Checkout Fields Editor Equalize Digital Accessibility Checker – Audit Your Website for WCAG, ADA, and Section 508 Accessibility Errors Salon Booking System WooCommerce EU VAT Assistant The Events Calendar Bulk Attachment Download ListPlus – Unlimited Listing Directory Menu Item Scheduler WP Photo Effects WordPress Reviews by ReviewPress Auto SEO META keywords (META tags keywords) optimization + WooCommerce Joli Table Of Contents One Click Login Email Header Footer Bulk Auto Image Title Attribute (Image Title tag) optimizer (Image SEO)Woocommerce Customers Order History Image Photo Gallery Final Tiles Grid Nitek Carousel Slider Cool Transitions Easy Zillow Reviews StreamCast – Radio Player for WordPress XT Variation Swatches for WooCommerce Menu Image, Icons made easy Cryptocurrency Portfolio Tracker WS Bootstrap WP Mobile Menu – The Mobile-Friendly Responsive Menu Fast Checkout for WooCommerce Smart Variations Images & Swatches for WooCommerce MailChimp Manager Wp My Admin Bar Deals of the Day WooCommerce Hasium Responsive Social Slider Widget Page Builder Gutenberg Blocks – Kioken Blocks Page Builder Sandwich – Front End WordPress Page Builder Plugin Livemesh SiteOrigin Widgets Viralike Custom Registration and Custom Login Forms with New Recaptcha Battle Suit for Divi JDs Portfolio SV Proven Expert VO Store Locator – WP Store Locator Plugin Reset Course Progress For LearnDash Front End PM RecurWP – WordPress Recurly Payment Gateway Glorious Services & Support Shuban Ivory Search – WordPress Search Plugin Server Info Blog Sidebar Widget Agy – Age verification for WooCommerce Google Analytics plugin for WordPress by GA4WP WP EasyPay – Square for WordPress WP Munich Blocks – Gutenberg Blocks for WordPress Premmerce Wishlist for WooCommerce Nokke Broadcast Lite WP Conference Schedule Easy Newsletter Signups Alley Business Toolkit Replyable – Subscribe to Comments and Reply by Email Number Chat Country Based Payments for WooCommerce Webinar Solution: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition Schema Plugin For Divi, Gutenberg & Shortcodes Power Ups for Elementor WordPress Everse Starter Sites – Elementor Templates Contact Form 7 Multi-Step Forms Accept Stripe Donation and Payments – AidWP Internal Link Juicer: SEO Auto Linker for WordPress Woo Ukrposhta Page Builder for Gutenberg – StarterBlocks Get feedback from visitors – WP Feedback Suite Plugin NEXUS Banner Management For WooCommerce Scheduled Notification Bar Ultimate Blocks – WordPress Blocks Plugin Genealogical Tree – WordPress Family Tree LearnMore Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations Product Author for WooCommerce Lightbox – EverlightBox Gallery Impexium Single Sign On Live TV Player – Worldwide Live TV Channels Player for WordPress Price Bands for WooCommerce Vit Website Reviews Revolution for Elementor GloriousThemes Starter Sites WordPress Robots.txt optimizer (+ XML Sitemap) – Boost SEO, Traffic & Rankings Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery Go Fetch Jobs (for WP Job Manager)Geo Mashup Five-Star Ratings Shortcode Activity Log For MainWP Content Aware Sidebars – Fastest Widget Area Plugin Bani Insert or Embed Articulate Content into WordPress Radio Station by netmix® – Manage and play your Show Schedule in WordPress!Anfrageformular – Multi Step Drag & Drop Formular Builder – Leadgenerierung Tabs with Recommended Posts (Widget)Performance Kit WP BugBot Tag Groups is the Advanced Way to Display Your Taxonomy Terms RW Divi Unite Gallery WP Get Personal Advance Menu Manager Bulk WooCommerce Category Creator WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes)LawPress – Law Firm Website Management TinyMCE Annotate Elation Elements for LifterLMS GFireM Fields Hooked Editable Content ConsultPress Lite FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel Categorify – WordPress Media Library Category & File Manager Restrict User Access – Ultimate Membership & Content Protection Justified Gallery Local Delivery Drivers for WooCommerce StreamWeasels Twitch Integration Focus on Reviews for WooCommerce WP Frontend Admin – Display WP Admin Pages in the Frontend Simple Sitemap – Create a Responsive HTML Sitemap Opensea Add Pinterest conversion tags for Pinterest Ads + Site verification WordPress Coupon Plugin for Bloggers and Marketers – WP Offers Cryptocurrency Product for WooCommerce Fast WordPress Extra Fees Plugin for WooCommerce Print My Blog – Print, PDF, & eBook Converter WordPress Plugin Streak CRM For Gmail For Contact Form 7 – WordPress Plugin Spotlight Social Feeds – Block, Shortcode, and Widget WP-HR Manager: The Human Resources Plugin for WordPress CAPTCHA 4WP – Antispam CAPTCHA solution for WordPress DeMomentSomTres Grid Archive Tarot Card Oracle Integrate Google Drive – Browse, Upload, Download, Embed, Play, Share, Gallery, and Manage Your Google Drive Files into Your WordPress Site WooCommerce Customers Table: View, Search, Bulk Editor Chat Button- Leads and Order over Chat All in One Invite Codes WP Meta and Date Remover Rating-Widget: Star Review System Surbma | GDPR Proof Cookie Consent & Notice Bar Easy Code Snippets Comments Not Replied To Image Carousel For Divi Cuisine Palace WP Radio – Worldwide Online Radio Stations Directory for WordPress Elasta Divi Collage Sparrow: Product Reviews and Ratings for WooCommerce SV Tracking Manager Ultra Elementor Addons WooCommerce Next Order Coupon WP Contact Slider Live Scores for SportsPress Past Events Extension Tiered Pricing Table for WooCommerce AnyWhere Elementor WP Coupons and Deals – WordPress Coupon Plugin Sky Login Redirect WPTools Masonry Gallery & Posts For Divi Nugget by Ingot: Easy, automated and native A/B testing for everyone WP Post Block Everse Product Options and Price Calculation Formulas for WooCommerce – Uni CPO Featured Images in RSS for Mailchimp & More FiboSearch – Ajax Search for WooCommerce Post Snippets – Custom WordPress Code Snippets Customizer WP Smart Export (Free)Coinbase Commerce – Crypto Gateway for WooCommerce WP Dev Powers – Display Screen Dimensions to Admin Plugin SSL Atlas – Free SSL Certificate & HTTPS Redirect for WordPress WP fail2ban – Advanced Security Plugin XT Floating Cart for WooCommerce Authorize.Net Payment Gateway For WooCommerce Divi Forms Styler – Gravity Forms, Fluent Forms & Contact Form 7 Multipurpose Gutenberg Block Food Store – Online Food Delivery & Pickup EthereumICO ACF for WooCommerce Product Premmerce Redirect Manager Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler KVoucher SheetPress – Manage WordPress Meta data with Google Sheets Live Drag and Drop Builder for Contact Form 7 Ultimate Widgets Light Podcast Box – Best Podcasting Plugin for WordPress Blocked in China | Check if your site is available in the Chinese mainland WP Author Bio WooCommerce upcoming Products Premmerce Brands for WooCommerce Video Player for YouTube Delete All Comments of wordpress Digital Goods for WooCommerce Checkout Bulk Edit Posts and Products in Spreadsheet Marijuana Age Verify WordPress News Plugin – TopNewsWp Premmerce WooCommerce Customers Manager CP Simple Newsletter WP Frontend Profile Easy Smooth Scroll Links – Smooth Scrolling Anchor Premmerce SEO for WooCommerce LittleBot Invoices Frontend Admin by DynamiApps Inbound Brew Checkout with Venmo on EDD Ultimate Post Kit Addons For Elementor – (Post Grid, Post Carousel, Post Slider, Category List, Post Tabs, Timeline, Post Ticker, Tag Cloud)WC Shop Sync – Square Payment Gateway for WooCommerce, Inventory Sync Between Square and WooCommerce, Ultimate WooCommerce Square Plugin Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO)Restrict – membership, site, content and user access restrictions for WordPress TK SmugMug Slideshow Shortcode WP-Cron Status Checker Strumenti Partita IVA per Woocommerce Elementor Addons by Livemesh Primary Addon for Elementor bbResolutions Ninja Libs Amazon SES WP SPID Italia Music Player for Elementor – Audio Player & Podcast Player Knowledge Base documentation & wiki plugin – BasePress Docs Modern Addons for Elementor Page Builder Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss WP Group Promoter Widgets on Pages Spreadsheet Integration – Automate Google Sheets With WordPress, WooCommerce & Most Popular Form Plugins. Also, Display Google sheet as a Table.SVG Flags – Beautiful Scalable Flags For All Countries!Anti-Spam by Fullworks : GDPR Compliant Spam Protection Bulk Edit Categories and Tags – Create Thousands Quickly on the Editor Delete old Posts automatically Premmerce Top Bar – PopUps – by WPOptin LMS Plugin – eLearning, Online Courses by Attest Post to Google My Business (Google Business Profile)EthPress – Web3 Login Unakit License Manager for WooCommerce Sync eCommerce NEO TK Google Fonts GDPR Compliant WP Affiliate Disclosure Blockspare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site Imports, No Coding Needed Speculor Domain Mapping System | Create Microsites with Multiple Alias Domains (multisite optional)Ultimate Gutenberg – Custom Block Templates Widgets on Pages and Posts Payment gateway per Product for WooCommerce WP Notification Bell ConeBlog – Elementor Blog Widgets WP Free SSL – Free SSL Certificate for WordPress and force HTTPS WP Table Builder – WordPress Table Plugin Media Library File Download Easy Social Feed – Social Photos Gallery – Post Feed – Like Box Checkout with Zelle on Woocommerce WP Emaily Unlimited Elements For Elementor (Free Widgets, Addons, Templates)Frontend Admin – Add and edit posts, pages, users and more all from the frontend NicheBase Limb Gallery | Create Beautiful Image & Video Galleries RevivePress – Keep your Old Content Evergreen Pixel Manager for WooCommerce – Track Google Analytics, Google Ads, TikTok and more Postcode Redirect W3SCloud Contact Form 7 to Zoho CRM Shared Files – Frontend File Upload Form & Secure File Sharing Grid & Styler For Contact Form 7 And Divi Block, Suspend, Report for BuddyPress Кнопка ЮMoney Change Price Title for WooCommerce ForceField Hide Shipping Method For WooCommerce WordPress SEO Checklist Events Addon for Elementor Send Prebuilt Emails WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, Security+Appointment & Event Booking Calendar Plugin – Webba Booking Delete Duplicate Posts Alt Manager Joli FAQ SEO – WordPress FAQ Plugin Change Prices with Time for WooCommerce Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress KRSP Frontend File Uploader Pay For Post with WooCommerce WooCommerce Bulk Edit Coupons – WP Sheet Editor Posts List Designer by Category – List Category Posts Or Recent Posts LocalSEOMap GFireM Action After BookPress – For Book Authors Add Expires Headers & Optimized Minify Coupon Affiliates – Affiliate Plugin for WooCommerce WP Activity Log Divi Content Restrictor Cartoon Url Events Calendar Registration Secure IP Logins Share This Image Dashy – Google Analytics advanced dashboard Amela WordPress Dev Powers – ACF Color Coded Field Types Plugin Gutenberg Blocks – ACF Blocks Suite Scrollsequence – Cinematic Scroll Image Animation Plugin Payment Gateway for PayFabric RankBear Awesome SSL Featured Products First for WooCommerce – A Extension of WooCommerce (WooCommerce Addon Plugin)South Pole: Climate action now Premmerce User Roles Add Twitter Pixel for Twitter ads Quote for WooCommerce Lite – Add to Quote Plugin Lets Customers Request Custom Quotes for Products using the Request a Quote Plugin for WooCommerce Availability datepicker – Integrate with Contact Form 7 and Divi WooCommerce PayPlug WPBITS Addons For Elementor Page Builder WP SMS Plugin – WordPress SMS Two Factor Authentication – 2FA, Two Factor, OTP SMS and Email Fullscreen Menu Fuse Social Floating Sidebar Videopack myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification Block Styler For Gravity Forms Premmerce Wholesale Pricing for WooCommerce Book BuyBack Prices Product Customer List for WooCommerce Gift Message for WooCommerce Easy Prayer Premmerce Multi-currency for Woocommerce Quick Paypal Payments Migrate WordPress Website & Backups – Prime Mover Iks Menu – WordPress Category Accordion Menu & FAQs Contact List – Premium Staff Listing, Business Directory Plugin & Address Book WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto Ultimeter Ethereum Wallet SurveyFunnel – Survey Plugin for WordPress ClickerVolt – Affiliate Links & Click Tracking for Performance Marketers WordPress Translation plugin for Post, Pages & WooCommerce products. Tranzly IO AI DeepL automatic WordPress Translator.azw woocommerce file uploads DeMomentSomTres Address WordPress Persistent Login Drop Shadow Boxes Generate Images – Magic Post Thumbnail AdFoxly – Ad Manager, AdSense Ads & Ads.txt Remove Add to Cart WooCommerce Dynamic Pricing and Discount Rules for WooCommerce Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player for WordPress WCC SEO Keyword Research FAQ Manager For Divi, Gutenberg Block & Shortcode Any Popup – Popup Forms, Optins & Ads Wadi Survey SlideDeck: Responsive WordPress Slider Plugin Document Viewer- Plugin to Display MS Office Docs XT Quick View for WooCommerce Place Order Without Payment for WooCommerce Better Sharing Team Collaboration Plugin for WordPress Editorial teams- Multicollab WP Travel Engine – Tour Booking Plugin – Tour Operator Software Better Elementor Addons Quick Event Manager Run Contests, Raffles, and Giveaways with ContestsWP SKT Templates – 100% free Elementor & Gutenberg templates Delivery for WooCommerce Quick Contact Form FAQ / Accordion / Docs – Helpie WordPress FAQ Accordion plugin Rocket Maintenance Mode & Coming Soon Page Ether and ERC20 tokens WooCommerce Payment Gateway WPVisitorInfo – Show Visitor Information & Conditional Data Based On That Information HM Multiple Roles Ultimate Carousel For Divi AFI – The Easiest Integration Plugin WP Moose Fraud Prevention For WooCommerce and EDD Best Responsive Comparison Table for Gutenberg Editor – NicheTable Add Tiktok Pixel for Tiktok ads (+Woocommerce)Contact Widgets For Elementor all the contact links you need in one place Protect Uploads with Login – Protect Your Uploads Bulk Edit and Create User Profiles – WP Sheet Editor Da Reactions Mass Pages/Posts Creator Wholesale for WooCommerce — This Wholesale Plugin Helps B2B and B2C Businesses Streamline Wholesale Products, Pricing, and User Roles, Automating their WooCommerce Wholesale Stores Quick Affiliate Store WordPress Animation Plugin – Animated Everything WPBakery Page Builder Addons by Livemesh Product Attachment for WooCommerce Announcement & Notification Banner – Bulletin All-in-One Video Gallery Social Gallery Lite Run time Image resizing WUPO Group Attributes for WooCommerce MapGeo – Interactive Geo Maps Pinblocks — Gutenberg blocks with Pinterest widgets Divi Torque Lite – Divi Theme and Extra Theme SocialMark – Easy Watermark/Logo on Social Media Post Link Share Preview SQL Reporting Services – SSRS Plugin for WordPress Get Directions Map Caxton – Create Pro page layouts in Gutenberg Ant Admin Notices for Team Better Messages – WCFM Integration Zip Code Redirect Redirection for Contact Form 7 Custom Login Page Customizer Get Better Reviews for WooCommerce New User Approve Turbo Widgets Mobile View for Responsive web design optimization (UX design) + Mobile Friendly Test Thank You Page for WooCommerce Builder for WooCommerce product reviews shortcodes – ReviewShort kk Star Ratings – Rate Post & Collect User Feedbacks Logo Showcase – Responsive Logo Carousel, Logo Slider & Logo Grid RaCar Clear Cart for WooCommerce DeMomentSomTres Media Tools Auto WordPress Google Translate Easy Tiktok Feed Modern Designs for Gravity Forms Easy Math Captcha for CF7 Filr – Secure document library Preloader for Divi Meridia Widget Detector for Elementor Brand Automatic YouTube Gallery Rest Routes – Custom Endpoints for WordPress REST API Purosa Yatri Tools WoowGallery – image gallery / content gallery / ecommerce gallery / social gallery / video gallery / album photo gallery WP Required Taxonomies – Categories and Tags Mandatory WordPress Books Gallery WP Disable Sitemap Add Linkedin insight tags for Linkedin ads Product Image Watermark for Woo Footer Plugin for Divi Overlay Image Divi Module Duplicate Variations for Woocommerce WooCommerce Google Analytics Integration By Advanced WC Analytics Drip Feed Content Extended for Learndash Error Log Monitor Blog Grid & Post Grid – Blog Post Slider, Blog Post Carousel, Blog Post Ticker, Blog Post Masonry, Category Post Grid By News & Blog Designer Pack Premmerce Product Search for WooCommerce YASR – Yet Another Star Rating Plugin for WordPress Multisite Robots.txt Manager Internal Linking for SEO traffic & Ranking – Auto internal links (100% automatic)Woo Admin Product Notes Royal Elementor Addons and Templates SnazzyAdmin WP Admin Theme Social Kit wGauge – Free Version Elementor Addon Elements WooCommerce Country Catalogs – Product Country Restrictions WordPress SEO Audit Plugin – WP Site Auditor WP Tools Divi Product Carousel Ads.txt & App-ads.txt Manager for WordPress Simple Sponsorships Kikote – Location Picker at Checkout & Google Address AutoFill Plugin for WooCommerce WP Page Templates Guest posting / Frontend Posting wordpress plugin – WP Front User Submit / Front Editor WordPress WooCommerce Sync for Google Sheet Booking Calendar | Appointment Booking | Bookit Flat Rate Shipping Plugin For WooCommerce Guestofy – Restaurant Reservations Plugin, Room Planer, Reservation Form WP Link Bio WordPress Dev Powers – Element Selector jQuery Powers Plugin Full Page Blog Designer TwentyFourth WP Scraper Block Slider – Responsive Image Slider, Video Slider & Post Slider Enhanced Ecommerce Google Analytics for WooCommerce Widget for Contact form 7 Stackable – Page Builder Gutenberg Blocks Simple Feature Requests Free – User Feedback Board BlockyPage – Gutenberg Based Page Builder WP AutoMedic Gallery PhotoBlocks Contact Form 7 – Capsule CRM – Integration Event Tickets and Registration Easy Settings for LearnDash WordPress Auto SEO Plugin – Upfiv SEO Wizard WP Relevant Ads Forms to Zapier, Integromat, IFTTT, Workato, Automate.io, elastic.io, Built.io, APIANT, Webhook User Menus – Nav Menu Visibility LittleBot ACH for Stripe + Plaid Under Construction Master Accordion ( Former WP Awesome FAQ Plugin )XT Points & Rewards for WooCommerce CF7 Constant Contact Fields Mapping WP Data Access – WordPress App, Table and Form Builder plugin Passster – Password Protect Pages and Content Out of stock display for woocommerce Clean Social Icons Checkout with Cash App on EDD AutoSave Net SSL Certificate – Free SSL, HTTPS by SSL Zen Gateway for PayLate on WooCommerce Court Reservation – Manage Your Court Bookings Online Affiliate Link Builder Plugin for Amazon Associates – Review Engine Advanced Custom Fields options import/export RT Easy Builder – Advanced addons for Elementor The best plugin for restrict content, support all Custom Post Types and Elementor – Password Protected Choice Payment Gateway for WooCommerce URL Shortify – Simple, Powerful and Easy URL Shortener Plugin For WordPress WooCommerce Shipping gateway per Product WP Tools Divi Blog Carousel Simple Social Page Widget & Shortcode Ultimate Bulk SEO Noindex Nofollow – Speed up Penalty Recovery Ultimate SEO Booster Education Addon for Elementor Advanced Classifieds & Directory Pro Code Manager HuCommerce | Magyar WooCommerce kiegészítések Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking Feedpress Generator – External RSS Frontend Customizer STAX Header Builder WP Google Street View (with 360° virtual tour) & Google maps + Local SEO Ultimate Divi Modules Suite – Divi Sumo Lite WordPress Buffer – HYPESocial. Social Media Auto Post, Social Media Auto Publish and Schedule FIT: Featured Image Toolkit Conversion de moneda Woocommerce WP Adminify – Custom WordPress Dashboard, Login and Admin Customizer Go Viral – social share, social sharebar, social locker, social chat, open graph, reactions, share & view counters WooCommerce Bulk Edit Products – WP Sheet Editor WP Sierra WordPress Gallery Plugin – Edge Photo Gallery Pootle Pagebuilder – WordPress Page builder Tickera – WordPress Event Ticketing

CWE ID-CWE-862

Missing Authorization

CVE-2023-41869

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.14% / 34.34%

7 Day CHG+0.02%

Published-13 Dec, 2024 | 14:24

Updated-16 Dec, 2024 | 17:55

WordPress WP Accessibility Helper (WAH) plugin <= 0.6.2.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in Alex Volkov WP Accessibility Helper (WAH) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Accessibility Helper (WAH): from n/a through 0.6.2.4.

Vendor-Alex Volkov

Product-WP Accessibility Helper (WAH)

CWE ID-CWE-862

Missing Authorization

CVE-2025-28996

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.04% / 10.74%

7 Day CHG~0.00%

Published-06 Jun, 2025 | 12:54

Updated-06 Jun, 2025 | 15:02

WordPress GPP Slideshow <= 1.3.5 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Thad Allender GPP Slideshow allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects GPP Slideshow: from n/a through 1.3.5.

Vendor-Thad Allender

Product-GPP Slideshow

CWE ID-CWE-862

Missing Authorization

CVE-2025-29010

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.04% / 10.74%

7 Day CHG~0.00%

Published-06 Jun, 2025 | 12:54

Updated-06 Jun, 2025 | 15:06

WordPress Behance Portfolio Manager <= 1.7.4 - Broken Access Control Vulnerability

Missing Authorization vulnerability in eleopard Behance Portfolio Manager allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Behance Portfolio Manager: from n/a through 1.7.4.

Vendor-eleopard

Product-Behance Portfolio Manager

CWE ID-CWE-862

Missing Authorization

CVE-2025-29001

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.03% / 8.16%

7 Day CHG~0.00%

Published-04 Jul, 2025 | 08:42

Updated-08 Jul, 2025 | 17:38

WordPress WooCommerce Shop Page Builder plugin <= 2.27.7 - Broken Access Control Vulnerability

Missing Authorization vulnerability in ZoomIt WooCommerce Shop Page Builder allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WooCommerce Shop Page Builder: from n/a through 2.27.7.

Vendor-ZoomIt

Product-WooCommerce Shop Page Builder

CWE ID-CWE-862

Missing Authorization

CVE-2025-29007

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.03% / 8.16%

7 Day CHG~0.00%

Published-04 Jul, 2025 | 08:42

Updated-08 Jul, 2025 | 17:38

WordPress LMSACE Connect plugin <= 3.4 - Broken Access Control Vulnerability

Missing Authorization vulnerability in LMSACE LMSACE Connect allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects LMSACE Connect: from n/a through 3.4.

Vendor-LMSACE

Product-LMSACE Connect

CWE ID-CWE-862

Missing Authorization

CVE-2025-26656

Matching Score-4

Assigner-SAP SE

View Details

Matching Score-4

Assigner-SAP SE

CVSS Score-4.3||MEDIUM

EPSS-0.04% / 12.79%

7 Day CHG~0.00%

Published-11 Mar, 2025 | 00:35

Updated-11 Mar, 2025 | 15:12

Missing Authorization check in S/4HANA (Manage Purchasing Info Records)

OData Service in Manage Purchasing Info Records does not perform necessary authorization checks for an authenticated user, allowing an attacker to escalate privileges. This has low impact on integrity of the application.

Vendor-SAP SE

Product-S/4HANA (Manage Purchasing Info Records)

CWE ID-CWE-862

Missing Authorization

CVE-2025-26871

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.06% / 17.40%

7 Day CHG~0.00%

Published-25 Feb, 2025 | 14:17

Updated-10 Apr, 2025 | 17:53

WordPress Essential Blocks plugin <= 4.8.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Essential Blocks for Gutenberg: from n/a through 4.8.3.

Vendor-WPDeveloper

Product-essential_blocks Essential Blocks for Gutenberg

CWE ID-CWE-862

Missing Authorization

CVE-2023-41689

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.06% / 19.03%

7 Day CHG+0.01%

Published-13 Dec, 2024 | 14:24

Updated-13 Dec, 2024 | 18:14

WordPress Post to Google My Business (Google Business Profile) plugin <= 3.1.14 - Broken Access Control vulnerability

Missing Authorization vulnerability in Koen Reus Post to Google My Business (Google Business Profile) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post to Google My Business (Google Business Profile): from n/a through 3.1.14.

Vendor-Koen Reus

Product-Post to Google My Business (Google Business Profile)

CWE ID-CWE-862

Missing Authorization

CVE-2025-24603

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.05% / 15.47%

7 Day CHG~0.00%

Published-27 Jan, 2025 | 14:22

Updated-12 Feb, 2025 | 20:41

WordPress Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce plugin <= 3.4.10 - Broken Access Control vulnerability

Missing Authorization vulnerability in UkrSolution Print Barcode Labels for your WooCommerce products/orders. This issue affects Print Barcode Labels for your WooCommerce products/orders: from n/a through 3.4.10.

Vendor-UkrSolution

Product-Print Barcode Labels for your WooCommerce products/orders

CWE ID-CWE-862

Missing Authorization

CVE-2025-24754

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.05% / 15.47%

7 Day CHG~0.00%

Published-27 Jan, 2025 | 13:59

Updated-27 Jan, 2025 | 14:24

WordPress Houzez theme <= 3.4.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Houzez.co Houzez. This issue affects Houzez: from n/a through 3.4.0.

Vendor-Houzez.co

Product-Houzez

CWE ID-CWE-862

Missing Authorization

CVE-2025-24743

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.05% / 15.47%

7 Day CHG~0.00%

Published-27 Jan, 2025 | 14:22

Updated-12 Feb, 2025 | 20:41

WordPress RomethemeKit For Elementor plugin <= 1.5.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Rometheme RomethemeKit For Elementor. This issue affects RomethemeKit For Elementor: from n/a through 1.5.2.

Vendor-Rometheme

Product-RomethemeKit For Elementor

CWE ID-CWE-862

Missing Authorization

CVE-2025-25120

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.05% / 14.14%

7 Day CHG~0.00%

Published-07 Feb, 2025 | 10:11

Updated-12 Feb, 2025 | 19:41

WordPress Slide Banners plugin <= 1.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Melodic Media Slide Banners allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Slide Banners: from n/a through 1.3.

Vendor-Melodic Media

Product-Slide Banners

CWE ID-CWE-862

Missing Authorization

CVE-2025-24972

Matching Score-4

Assigner-GitHub, Inc.

View Details

Matching Score-4

Assigner-GitHub, Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.04% / 8.90%

7 Day CHG~0.00%

Published-26 Mar, 2025 | 14:15

Updated-27 Mar, 2025 | 16:45

Discourse may bypass user preference when adding users to chat groups

Discourse is an open-source discussion platform. Prior to versions `3.3.4` on the `stable` branch and `3.4.0.beta5` on the `beta` branch, in specific circumstances, users could be added to group direct messages despite disabling direct messaging in their preferences. Versions `3.3.4` and `3.4.0.beta5` contain a patch for the issue. A workaround is available. If a user disables chat in their preferences then they cannot be added to new group chats.

Vendor-Civilized Discourse Construction Kit, Inc.

Product-discourse

CWE ID-CWE-862

Missing Authorization

CVE-2023-41046

Matching Score-4

Assigner-GitHub, Inc.

View Details

Matching Score-4

Assigner-GitHub, Inc.

CVSS Score-6.3||MEDIUM

EPSS-0.10% / 27.82%

7 Day CHG~0.00%

Published-01 Sep, 2023 | 19:59

Updated-30 Sep, 2024 | 20:20

Velocity execution without script rights in Xwiki platform

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible in XWiki to execute Velocity code without having script right by creating an XClass with a property of type "TextArea" and content type "VelocityCode" or "VelocityWiki". For the former, the syntax of the document needs to be set the `xwiki/1.0` (this syntax doesn't need to be installed). In both cases, when adding the property to an object, the Velocity code is executed regardless of the rights of the author of the property (edit right is still required, though). In both cases, the code is executed with the correct context author so no privileged APIs can be accessed. However, Velocity still grants access to otherwise inaccessible data and APIs that could allow further privilege escalation. At least for "VelocityCode", this behavior is most likely very old but only since XWiki 7.2, script right is a separate right, before that version all users were allowed to execute Velocity and thus this was expected and not a security issue. This has been patched in XWiki 14.10.10 and 15.4 RC1. Users are advised to upgrade. There are no known workarounds.

Vendor-XWiki SAS

Product-xwiki xwiki-platform

CWE ID-CWE-862

Missing Authorization

CVE-2025-24649

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.06% / 17.80%

7 Day CHG+0.01%

Published-24 Jan, 2025 | 17:24

Updated-24 Jan, 2025 | 18:57

WordPress Admin and Site Enhancements (ASE) Plugin <= 7.6.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in wpase.com Admin and Site Enhancements (ASE) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Admin and Site Enhancements (ASE): from n/a through 7.6.2.

Vendor-wpase.com

Product-Admin and Site Enhancements (ASE)

CWE ID-CWE-862

Missing Authorization

CVE-2025-24736

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.06% / 17.80%

7 Day CHG+0.01%

Published-24 Jan, 2025 | 17:25

Updated-09 Jun, 2025 | 19:00

WordPress Post Duplicator plugin <= 2.35 - Broken Access Control vulnerability

Missing Authorization vulnerability in Metaphor Creations Post Duplicator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post Duplicator: from n/a through 2.35.

Vendor-metaphorcreations Metaphor Creations

Product-post_duplicator Post Duplicator

CWE ID-CWE-862

Missing Authorization

CVE-2025-24653

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.05% / 15.47%

7 Day CHG~0.00%

Published-27 Jan, 2025 | 14:22

Updated-12 Feb, 2025 | 20:41

WordPress Admin and Site Enhancements (ASE) Pro Plugin <= 7.6.1.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in NotFound Admin and Site Enhancements (ASE) Pro allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Admin and Site Enhancements (ASE) Pro: from n/a through 7.6.1.1.

Vendor-NotFound

Product-Admin and Site Enhancements (ASE) Pro

CWE ID-CWE-862

Missing Authorization

CVE-2025-24618

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.07% / 22.12%

7 Day CHG+0.01%

Published-24 Jan, 2025 | 17:24

Updated-24 Jan, 2025 | 18:59

WordPress ElementInvader Addons for Elementor Plugin <= 1.3.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in ElementInvader ElementInvader Addons for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ElementInvader Addons for Elementor: from n/a through 1.3.1.

Vendor-ElementInvader

Product-ElementInvader Addons for Elementor

CWE ID-CWE-862

Missing Authorization

CVE-2025-24613

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.06% / 17.80%

7 Day CHG+0.01%

Published-24 Jan, 2025 | 17:24

Updated-24 Jan, 2025 | 18:58

WordPress FV Thoughtful Comments plugin <= 0.3.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in Foliovision FV Thoughtful Comments allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects FV Thoughtful Comments: from n/a through 0.3.5.

Vendor-Foliovision

Product-FV Thoughtful Comments

CWE ID-CWE-862

Missing Authorization

CVE-2025-24693

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.06% / 17.80%

7 Day CHG+0.01%

Published-24 Jan, 2025 | 17:24

Updated-24 Jan, 2025 | 18:55

WordPress Advanced Notifications plugin <= 1.2.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in Yehi Advanced Notifications allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Advanced Notifications: from n/a through 1.2.7.

Vendor-Yehi

Product-Advanced Notifications

CWE ID-CWE-862

Missing Authorization

CVE-2023-3999

Matching Score-4

Assigner-Wordfence

View Details

Matching Score-4

Assigner-Wordfence

CVSS Score-6.3||MEDIUM

EPSS-0.01% / 1.92%

7 Day CHG~0.00%

Published-31 Aug, 2023 | 05:33

Updated-05 Feb, 2025 | 19:34

The Waiting: One-click countdowns plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on its AJAX calls in versions up to, and including, 0.6.2. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to create and delete countdowns as well as manipulate other plugin settings.

Vendor-plugin pluginbuilders

Product-waiting Waiting: One-click countdowns

CWE ID-CWE-862

Missing Authorization

CVE-2022-4937

Matching Score-4

Assigner-Wordfence

View Details

Matching Score-4

Assigner-Wordfence

CVSS Score-6.3||MEDIUM

EPSS-0.25% / 48.45%

7 Day CHG~0.00%

Published-05 Apr, 2023 | 17:40

Updated-13 Jan, 2025 | 16:55

The WCFM Frontend Manager plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and including, 6.6.0 due to missing capability checks on various AJAX actions. This makes it possible for authenticated attackers, with minimal permissions such as subscribers, to perform a wide variety of actions such as modifying knowledge bases, modifying notices, modifying payments, managing vendors, capabilities, and so much more. There were hundreds of AJAX endpoints affected.

Vendor-wclovers wclovers

Product-frontend_manager_for_woocommerce_along_with_bookings_subscription_listings_compatible WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible

CWE ID-CWE-862

Missing Authorization

CVE-2025-23954

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.06% / 17.80%

7 Day CHG~0.00%

Published-16 Jan, 2025 | 20:08

Updated-17 Jan, 2025 | 20:24

WordPress Salvador – AI Image Generator plugin <= 1.0.11 - Broken Access Control vulnerability

Missing Authorization vulnerability in AWcode & KingfisherFox Salvador – AI Image Generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salvador – AI Image Generator: from n/a through 1.0.11.

Vendor-AWcode & KingfisherFox

Product-Salvador – AI Image Generator

CWE ID-CWE-862

Missing Authorization

CVE-2025-23957

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.06% / 17.80%

7 Day CHG~0.00%

Published-16 Jan, 2025 | 20:08

Updated-17 Jan, 2025 | 17:38

WordPress Sur.ly plugin <= 3.0.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Sur.ly Sur.ly allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sur.ly: from n/a through 3.0.3.

Vendor-Sur.ly

Product-Sur.ly

CWE ID-CWE-862

Missing Authorization

CVE-2025-23929

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.06% / 17.80%

7 Day CHG~0.00%

Published-16 Jan, 2025 | 20:07

Updated-17 Jan, 2025 | 18:57

WordPress Email Capture & Lead Generation Plugin <= 1.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in wishfulthemes Email Capture & Lead Generation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Email Capture & Lead Generation: from n/a through 1.0.2.

Vendor-wishfulthemes

Product-Email Capture & Lead Generation

CWE ID-CWE-862

Missing Authorization

CVE-2023-4106

Matching Score-4

Assigner-Mattermost, Inc.

View Details

Matching Score-4

Assigner-Mattermost, Inc.

CVSS Score-6.3||MEDIUM

EPSS-0.09% / 26.67%

7 Day CHG~0.00%

Published-11 Aug, 2023 | 06:12

Updated-01 Oct, 2024 | 20:21

A guest user can perform various actions on public playbooks

Mattermost fails to check if the requesting user is a guest before performing different actions to public playbooks, resulting a guest being able to view, join, edit, export and archive public playbooks.

Vendor-Mattermost, Inc.

Product-mattermost Mattermost

CWE ID-CWE-862

Missing Authorization

CVE-2025-23955

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.06% / 17.80%

7 Day CHG~0.00%

Published-16 Jan, 2025 | 20:08

Updated-17 Jan, 2025 | 20:07

WordPress Xola plugin <= 1.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in xola.com Xola allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Xola: from n/a through 1.6.

Vendor-xola.com

Product-Xola

CWE ID-CWE-862

Missing Authorization

CVE-2025-23999

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.04% / 10.74%

7 Day CHG~0.00%

Published-18 Jun, 2025 | 09:26

Updated-18 Jun, 2025 | 13:46

WordPress Breeze plugin <= 2.2.13 - Broken Access Control vulnerability

Missing Authorization vulnerability in Cloudways Breeze allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze: from n/a through 2.2.13.

Vendor-Cloudways

Product-Breeze

CWE ID-CWE-862

Missing Authorization

CVE-2025-24591

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.10% / 27.87%

7 Day CHG+0.01%

Published-24 Jan, 2025 | 17:24

Updated-24 Jan, 2025 | 19:02

WordPress GDPR CCPA Compliance & Cookie Consent Banner plugin <= 2.7.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in NinjaTeam GDPR CCPA Compliance Support allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects GDPR CCPA Compliance Support: from n/a through 2.7.1.

Vendor-NinjaTeam

Product-GDPR CCPA Compliance Support

CWE ID-CWE-862

Missing Authorization

CVE-2023-40362

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-2.03% / 83.08%

7 Day CHG~0.00%

Published-12 Jan, 2024 | 00:00

Updated-20 Jun, 2025 | 17:15

An issue was discovered in CentralSquare Click2Gov Building Permit before October 2023. Lack of access control protections allows remote attackers to arbitrarily delete the contractors from any user's account when the user ID and contractor information is known.

Vendor-centralsquare n/a

Product-click2gov_building_permit n/a

CWE ID-CWE-862

Missing Authorization

CVE-2025-23785

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.08% / 24.12%

7 Day CHG~0.00%

Published-16 Jan, 2025 | 20:06

Updated-17 Jan, 2025 | 19:09

WordPress AI Responsive Gallery Album plugin <= 1.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in August Infotech AI Responsive Gallery Album allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Responsive Gallery Album: from n/a through 1.4.

Vendor-August Infotech

Product-AI Responsive Gallery Album

CWE ID-CWE-862

Missing Authorization

CVE-2025-23776

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.08% / 24.12%

7 Day CHG~0.00%

Published-16 Jan, 2025 | 20:06

Updated-17 Jan, 2025 | 19:11

WordPress Cache Sniper for Nginx plugin <= 1.0.4.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Thorn Technologies LLC Cache Sniper for Nginx allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cache Sniper for Nginx: from n/a through 1.0.4.2.

Vendor-Thorn Technologies LLC

Product-Cache Sniper for Nginx

CWE ID-CWE-862

Missing Authorization

CVE-2025-23930

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.06% / 17.80%

7 Day CHG~0.00%

Published-16 Jan, 2025 | 20:07

Updated-17 Jan, 2025 | 18:56

WordPress PayPal Marketing Solutions plugin <= 1.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in iTechArt-Group PayPal Marketing Solutions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PayPal Marketing Solutions: from n/a through 1.2.

Vendor-iTechArt-Group

Product-PayPal Marketing Solutions

CWE ID-CWE-862

Missing Authorization

CVE-2023-39995

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.11% / 29.37%

7 Day CHG+0.01%

Published-13 Dec, 2024 | 14:23

Updated-13 Dec, 2024 | 18:46

WordPress Portfolio and Projects plugin <= 1.3.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP OnlineSupport, Essential Plugin Portfolio and Projects allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Portfolio and Projects: from n/a through 1.3.7.

Vendor-WP OnlineSupport, Essential Plugin

Product-Portfolio and Projects

CWE ID-CWE-862

Missing Authorization

CVE-2025-23962

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.06% / 17.80%

7 Day CHG~0.00%

Published-16 Jan, 2025 | 20:08

Updated-17 Jan, 2025 | 20:23

WordPress Goldstar plugin <= 2.1.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Goldstar Goldstar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Goldstar: from n/a through 2.1.1.

Vendor-Goldstar

Product-Goldstar

CWE ID-CWE-862

Missing Authorization

CVE-2025-24584

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.05% / 15.47%

7 Day CHG~0.00%

Published-27 Jan, 2025 | 13:59

Updated-27 Jan, 2025 | 14:41

WordPress Ultimate Store Kit Elementor Addons plugin <= 2.3.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in BdThemes Ultimate Store Kit Elementor Addons allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ultimate Store Kit Elementor Addons: from n/a through 2.3.0.

Vendor-BdThemes

Product-Ultimate Store Kit Elementor Addons

CWE ID-CWE-862

Missing Authorization

CVE-2025-23991

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.06% / 17.80%

7 Day CHG+0.01%

Published-24 Jan, 2025 | 15:31

Updated-24 Jan, 2025 | 16:15

WordPress Product Size Charts Plugin for WooCommerce plugin <= 2.4.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in theDotstore Product Size Charts Plugin for WooCommerce.This issue affects Product Size Charts Plugin for WooCommerce: from n/a through 2.4.5.

Vendor-theDotstore

Product-Product Size Charts Plugin for WooCommerce

CWE ID-CWE-862

Missing Authorization

CVE-2022-4948

Matching Score-4

Assigner-Wordfence

View Details

Matching Score-4

Assigner-Wordfence

CVSS Score-4.3||MEDIUM

EPSS-0.03% / 6.13%

7 Day CHG~0.00%

Published-07 Jun, 2023 | 01:51

Updated-20 Dec, 2024 | 23:52

The FlyingPress plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up to, and including, 3.9.6. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to interact with the plugin in ways administrators are intended to. One action (save_config) allows for the configuration of an external CDN. This could be used to include malicious javascript from a source controlled by the attacker.

Vendor-flying-press FlyingWeb

Product-flyingpress FlyingPress

CWE ID-CWE-862

Missing Authorization

CVE-2021-4366

Credits

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs