ByteOS Network

Vulnerability Details :

CVE-2024-35729

Assigner Org ID-21595511-bba5-4825-b968-b78d1f9984a3

Published At-10 Jun, 2024 | 07:44

Updated At-28 Apr, 2026 | 16:09

WordPress Tickera plugin <= 3.5.2.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in Tickera Tickera tickera-event-ticketing-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tickera: from n/a through <= 3.5.2.6.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:Patchstack

Assigner Org ID:21595511-bba5-4825-b968-b78d1f9984a3

Published At:10 Jun, 2024 | 07:44

Updated At:28 Apr, 2026 | 16:09

▼CVE Numbering Authority (CNA)

WordPress Tickera plugin <= 3.5.2.6 - Broken Access Control vulnerability

Affected Products

Vendor

Tickera

Product

Tickera

Collection URL

https://wordpress.org/plugins

Package Name

tickera-event-ticketing-system

Default Status

unaffected

Versions

Affected

From 0 through 3.5.2.6 (custom)
- -> unaffectedfrom3.5.2.7

Problem Types

Type	CWE ID	Description
CWE	CWE-862	Missing Authorization

Type: CWE

CWE ID: CWE-862

Description: Missing Authorization

Metrics

Version	Base score	Base severity	Vector
3.1	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Version: 3.1

Base score: 5.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Impacts

CAPEC ID	Description
CAPEC-180	Exploiting Incorrectly Configured Access Control Security Levels

CAPEC ID: CAPEC-180

Description: Exploiting Incorrectly Configured Access Control Security Levels

Credits

finder

Manab Jyoti Dowarah | Patchstack Bug Bounty Program

References

Hyperlink	Resource
https://patchstack.com/database/Wordpress/Plugin/tickera-event-ticketing-system/vulnerability/wordpress-tickera-wordpress-event-ticketing-plugin-3-5-2-6-broken-access-control-vulnerability?_s_id=cve	vdb-entry

Hyperlink: https://patchstack.com/database/Wordpress/Plugin/tickera-event-ticketing-system/vulnerability/wordpress-tickera-wordpress-event-ticketing-plugin-3-5-2-6-broken-access-control-vulnerability?_s_id=cve

Resource:

vdb-entry

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://patchstack.com/database/vulnerability/tickera-event-ticketing-system/wordpress-tickera-wordpress-event-ticketing-plugin-3-5-2-6-broken-access-control-vulnerability?_s_id=cve	vdb-entry x_transferred

Hyperlink: https://patchstack.com/database/vulnerability/tickera-event-ticketing-system/wordpress-tickera-wordpress-event-ticketing-plugin-3-5-2-6-broken-access-control-vulnerability?_s_id=cve

Resource:

vdb-entry

x_transferred

2. CISA ADP Vulnrichment

Affected Products

Vendor

tickera

Product

tickera

CPEs

cpe:2.3:a:tickera:tickera:*:*:*:*:*:wordpress:*:*

Default Status

unknown

Versions

Affected

From 0 through 3.5.2.6 (custom)

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:audit@patchstack.com

Published At:10 Jun, 2024 | 08:15

Updated At:23 Apr, 2026 | 15:18

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary	3.1	8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Type: Secondary

Version: 3.1

Base score: 5.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Type: Primary

Version: 3.1

Base score: 8.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CPE Matches

tickera>>tickera>>Versions before 3.5.2.7(exclusive)

cpe:2.3:a:tickera:tickera:*:*:*:*:*:wordpress:*:*

Weaknesses

CWE ID	Type	Source
CWE-862	Secondary	audit@patchstack.com
CWE-862	Primary	nvd@nist.gov

CWE ID: CWE-862

Type: Secondary

Source: audit@patchstack.com

CWE ID: CWE-862

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://patchstack.com/database/Wordpress/Plugin/tickera-event-ticketing-system/vulnerability/wordpress-tickera-wordpress-event-ticketing-plugin-3-5-2-6-broken-access-control-vulnerability?_s_id=cve	audit@patchstack.com	N/A
https://patchstack.com/database/vulnerability/tickera-event-ticketing-system/wordpress-tickera-wordpress-event-ticketing-plugin-3-5-2-6-broken-access-control-vulnerability?_s_id=cve	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory

Source: audit@patchstack.com

Resource: N/A

Hyperlink: https://patchstack.com/database/vulnerability/tickera-event-ticketing-system/wordpress-tickera-wordpress-event-ticketing-plugin-3-5-2-6-broken-access-control-vulnerability?_s_id=cve

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Similar CVEs

1546Records found

CVE-2025-67939

Matching Score-6

Assigner-Patchstack

View Details

Matching Score-6

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.33% / 25.82%

7 Day CHG~0.00%

Published-22 Jan, 2026 | 16:51

Updated-28 Apr, 2026 | 16:14

WordPress Tickera plugin <= 3.5.6.2 - Broken Access Control vulnerability

Vendor-Tickera

Product-Tickera

CWE ID-CWE-862

Missing Authorization

CVE-2022-4974

Matching Score-6

Assigner-Wordfence

View Details

Matching Score-6

Assigner-Wordfence

CVSS Score-6.3||MEDIUM

EPSS-0.44% / 36.21%

7 Day CHG+0.02%

Published-16 Oct, 2024 | 06:43

Updated-15 Apr, 2026 | 00:35

Freemius SDK <= 2.4.2 - Missing Authorization Checks

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.

Vendor-themelocation masterblocks pootlepress/pmbaldha thecodechime limbcode wptb dots cmbibby/maxsdesign kaggdesign dgwyer glowlogix ggriesser wpvibes matstars fsruslan milukove multicollab wpconedev theafricanboss giladtakoni dashlabsltd bilaltas milmor kenanfallon darell scrollsequence wpscripts vernal xyulex shamim51 ultradevs seancarrico tobias_conrad/sebet edgegalleryplugin badhonrocks blockypage passionatebrains coderpress lynn999 salttechno dotrex anfrageformular djenh munirkamal wpjoli oloyede-jamiu stevejburge alex-ye samdani wpsoul benmoreassynt zeetheme danielealessandra shawoninfo jaydeep-nimavat fullworks co2ok kartikparmar smgteam woopops dipcode blockspare deothemes wpgeniuz wpchill melapress alphabposervice mikebels creativethemeshq infornweb mdedev wpbits mikewire_rocksolid xjohnyk premmerce cebbi plugins360 wpmagics royalnavneet pluginsware pluginandplay brightvesseldev pagebuildersandwich gowebsmarty mcurly pippozanardo codexonics prasadkirpekar bavokoservices ejslondon/oceanwp gloriousthemes setka imtiazrayhan sebet/themesei wpcohort cloudsponge woodyhayday meeplugins wpt00ls versacomp olezhyk5 ivacy dejanmarkovic jurski davidanderson bestpluginswordpress dovyp flexithemes pasyuk patrickposner mohsinoffline dvizhenia surbma blockmeister themeythemes powerfulwp peterschulznl sjaved wphrmanager streamweasels prelc staxwp modulemasters risetheme elbisnero andyabelow pootlepress maurolopes/wpdive iksstudio sindyakinsergei wplegalpages webba-agency popeating dangub86 mattpramschufer kaira bandido ivan_paulin koen12344 livemesh tprintyedisonave cromer12 nicheaddons drosendo princeahmed damian-gora dam6pl mberding linekal jamesparkninja ankitmaru listplus commercepundit kaizencoders wpsaad maltathemes boriscolombier/penguininitiatives diviframework jetixwp webheadllc snazzythemes maartenbelmans anssilaitila jcodex vinod-dalvi slidedeck lukeseager cloudliving paulio21 cypressnorth fooplugins cadudecastroalves alekv kylegilman upfiv zerozendesign infosatech wptravelengine codesavory khothemes shelob9 ronena100 switcorp sorsawo walkerwp akdevs webmuehle interfacelab skyminds codeies wpmunich sslatlas halmat kartechify mumarym1985 xplodedthemes themekraft marviorocha kitthemes ggwicz krsp buttonizer mojofywp johnc1979 rebelcode ivanchernyakov skshaikat themesty gkher/5starplugins thijzie spartac aharonyan proteusthemes aguilerasoft nitin247 cyberhobo wpdelicious ultimateblocks sakurapixel mhmrajib saadiqbal wpdevpowers wpeka-club mvvapps/litonice13 josevega lostboy7 danieliser essekia daniyalahmedk kartikparmar/sangaran tonyzeoli tropicalista foxmoon wpdever wpmoose vanyukov milukove/stylingwebben takanakui wordplus patrickgarman danish-ali mte90 inputwp sonalsinha21 thinleek wordpresschef closemarketing/mbrown24 invisnet janwyl galoover wpkube atakanoz ggedde boltonstudios properfraction majick/dudo bouncingsprout samuelsilvapt wisersteps tobias_conrad lkoudal renaudbod w3scloud uriahs-victor beeneeb tribalnerd matthias-reuter frostbourn nplugins closetechnology moomooagency greenjaymedia getsparrow vincoit theafricanboss/cleverplugins whiteshadow ethereumicoio h3technologies therealwebdisrupt elementinvader chillichalli muhammad-rehman usmanaliqureshi tauhidpro ekanath irkanu vohotv/wpeventpartners/mohammedrezq stevehenty daigo75 bplugins attest chetmac sj_o eedee ibenic protectyouruploads marcqueralt fastaf/alleythemes anasbinmukim blackandwhitedigital meowcrew mnelson4 ldninjas/divisumo shabti rafacarvalhido rafalosinski rankbear wp-making 9brada6 intoxstudio jburleigh1 wpcohort/tripetto hiddenpearls elliotvs pmbaldha/interactivegeomaps tickera ahmed17 hqtheme avidthemes/unitecms gfirem alexmoss dreamfox sslzen bfintal svovaf sovstack wgauge nasirahmed oceas equalizedigital richard-b cliffpaulick seezee weconnectcode actuaryzask majick brandonfire janthielemann gallerycreator frenify clickervolt syntactics mihail-barinov smartwpress wupo bycrik jkohlbach maciejbak85 tranzly pagup javmah mantrabrain jwebsol annastaa jwind wpengine ninjalibs humblethemes kkikuchi1220 toddhalfpenny starfishwp BdThemes Royal Elementor Addons The Events Calendar (StellarWP)WPWeb Elite Themeisle

Product-annasta Filters for WooCommerce Battle Suit for Divi Better Robots.txt – AI-Ready Crawl Control & Bot Governance Styler Mate for Contact Form 7 eaSYNC Booking – Hotels, Restaurants & Car Rentals Widget Detector for Elementor Tickera – Sell Tickets & Manage Events Block Slider – Responsive Image Slider, Video Slider & Post Slider GloriousThemes Starter Sites Gateway for PayLate on WooCommerce Ultimate Post Kit Addons for Elementor Divi Content Restrictor Livemesh Addons for Beaver Builder Widgets on Pages and Posts Event Tickets and Registration WP Page Templates AutoSave Net AWCA – The Great Analytics Insights for Your eStore WebinarIgnition – Live, Automated & Evergreen Webinars for WooCommerce Insert or Embed Articulate Content into WordPress Form Vibes – Database Manager for Forms Quick Contact Form Local Delivery Drivers for WooCommerce Addon Elements for Elementor (formerly Elementor Addon Elements)Media Cloud for Bunny CDN, Amazon S3, Cloudflare R2, Google Cloud Storage, DigitalOcean and more Menu Item Scheduler Expire tags Add Pinterest conversion tags for Pinterest Ads + Site verification GA4WP – Analytics Dashboard for the Website HM Multiple Roles WP Search Filter Place Order Without Payment for WooCommerce BookPress – For Book Authors Music Player for Elementor – Audio Player & Podcast Player Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)Bulk Attachment Download WordPress Dev Powers – ACF Color Coded Field Types Plugin Post Carousel Divi WP Google Street View (with 360° virtual tour) & Google maps + Local SEO Automatic Internal Links for SEO by Pagup Easy Post Views Count Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress WordPress Gallery Plugin – Edge Photo Gallery Bulk WooCommerce Category Creator Booking Addon for WooCommerce Easy Prayer Ukrposhta Premmerce Variation Swatches for WooCommerce The Events Calendar TK Google Fonts GDPR Compliant Guest posting / Frontend Posting / Front Editor – WP Front User Submit Duplicate Variations for Woocommerce CF7 Constant Contact Fields Mapping Geo Mashup Replyable – Subscribe to Comments and Reply by Email WP Photo Effects Menu Image, Icons made easy Awesome SSL FiboSearch – Ajax Search for WooCommerce Product Image Watermark for Woo Better Sharing Premmerce RT Easy Builder – Advanced addons for Elementor All-in-One Video Gallery TinyMCE Annotate KVoucher WP fail2ban – Advanced Security Da Reactions Payment Gateway for PayFabric Notification Bar, Announcement and Cookie Notice WordPress Plugin – FooBar NotifSMS – SMS Notifications OTP & 2FA for WordPress & WooCommerce WP Easy Pay – Payment and Donation form Builder for Square Conversion de moneda Woocommerce Customers Table for WooCommerce: View, Search, Bulk Editor Schema Plugin For Divi, Gutenberg & Shortcodes Master Accordion ( Former WP Awesome FAQ Plugin )Masonry Gallery & Posts For Divi (WP Tools)Blocksy Companion Royal Addons for Elementor – Addons and Templates Kit for Elementor BlockSpare — News, Magazine and Blog Addons for (Gutenberg) Block Editor WP Get Personal Post Slider and Post Carousel with Post Vertical Scrolling Widget – A Responsive Post Slider Get Better Reviews for WooCommerce Inbound Brew Simple Feature Requests Free – User Feedback Board Anfrageformular – Multi Step Drag & Drop Formular Builder – Leadgenerierung Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance WordPress Coupon Plugin for Bloggers and Marketers – WP Offers Easy Code Snippets DeMomentSomTres Address DeMomentSomTres Media Tools Auto Market Exporter WP Gratify HQTheme Extra SlideDeck: Responsive WordPress Slider Plugin Multi Page Auto Advance for Gravity Forms WP BugBot Deals of the Day WooCommerce bbResolutions Smart Variations Images & Swatches for WooCommerce Premmerce Wishlist for WooCommerce Revolution for Elementor Easy Social Feed – Social Photos Gallery and Post Feed for WordPress Payment Gateway Per Product for WooCommerce WP Notification Bell Helpie FAQ — Accordion, Docs & Knowledge Base Frontend group restriction for LearnDash Widgets for WooCommerce Products on Elementor Nugget by Ingot: Easy, automated and native A/B testing for everyone Greenshift – animation and page builder blocks STEWoo – Super Transactional Emails for WooCommerce The best plugin for restrict content, support all Custom Post Types and Elementor – Password Protected Flat Rate Shipping Method for WooCommerce Simple Sitemap – Create a Responsive HTML Sitemap ClickerVolt – Affiliate Links & Click Tracking for Performance Marketers WooCommerce Next Order Coupon NEXUS CAPTCHA 4WP – Antispam CAPTCHA solution for WordPress WP Relevant Ads Iks Menu – WordPress Category Accordion Menu & FAQs WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards Marijuana Age Verify WooCommerce upcoming Products Events Calendar Registration Choice Payment Gateway for WooCommerce Filr – Secure document library WOW Styler for CF7 – Visual Styler for Contact Form 7 Forms Page Builder Sandwich – Front End WordPress Page Builder Plugin Better Addons for Elementor Cuisine Palace SVG Flags – Beautiful Scalable Flags For All Countries!VidSEO – Video transcript embedding for WordPress & LLM Rating-Widget: Star Review System Cryptocurrency Product for WooCommerce New User Approve Unakit Go Fetch Jobs (for WP Job Manager)Pixel Manager for WooCommerce – Conversion Tracking, Google Ads, GA4, TikTok, Dynamic Remarketing Automizy Gravity Forms RaCar Clear Cart for WooCommerce WP-HR Manager: The Human Resources Plugin for WordPress Really Simple Featured Video – Featured Video Support for Posts, Pages & WooCommerce Products WordPress Auto SEO Plugin – Upfiv SEO Wizard Cookie Banner for GDPR / CCPA – WPLP Cookie Consent Funnelmentals Shipping Gateway Per Product for WooCommerce DeMomentSomTres Grid Archive License Manager for WooCommerce Vit Website Reviews LawPress – Law Firm Website Management Speculor Aquarella Lite Joli Table Of Contents WP Travel Engine – Tour Booking Plugin – Tour Operator Software Reset Course Progress For LearnDash Responsive Social Slider Widget Nitek Carousel Slider Cool Transitions Number Chat StreamWeasels Twitch Integration TreePress – Easy Family Trees & Ancestor Profiles Events Addon for Elementor Contact List – Online Staff Directory & Address Book Protect Uploads with Login – Protect Your Uploads Frontend Admin by DynamiApps Wholesale for WooCommerce Full Page Blog Designer Agy – Age verification for WooCommerce EthereumICO Fuse Social Floating Sidebar MOBILOOK — Mobile View & Mobile‑Friendly Test Server Info Categorify – WordPress Media Library Category & File Manager WUPO Group Attributes for WooCommerce LMS Plugin – eLearning, Online Courses by Attest Mixed Media Gallery Blocks WordPress Slider Block Gutenslider Blog Sidebar Widget Ocean Extra NicheTable – Responsive Comparison Table Block Glossary ConeBlog – Elementor Blog Widgets XT Floating Cart for WooCommerce AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization Under Construction Elation All in One Invite Codes LittleBot Invoices Ultra Elementor Addons Custom Registration and Custom Login Forms with New Recaptcha Media Library File Download Secure IP Logins Domain Mapping System | Create Microsites with Multiple Alias Domains (multisite optional)Team Members – A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More Clean Social Icons Coupon Affiliates – Affiliate Plugin for WooCommerce Country Based Payments for WooCommerce Footer Plugin for Divi Image Carousel For Divi Age Verification Screen for WooCommerce Delivery for WooCommerce Price Bands for WooCommerce Pootle Pagebuilder – WordPress Page builder SEO Audit – WP Site Auditor Social Gallery Lite Contact Form 7 – Capsule CRM – Integration Everse Custom Login Page Customizer Run time Image resizing Bookit — Booking & Appointment Calendar Five-Star Ratings Shortcode WordPress Everse Starter Sites – Elementor Templates SurveyFunnel – Survey Plugin for WordPress Gutenberg Blocks – ACF Blocks Suite WP Disable Sitemap Pro Broken Links Maintainer Custom WooCommerce Checkout Fields Editor Add Tiktok Pixel for Tiktok ads (+Woocommerce)Security Safe Feedpress Generator – External RSS Frontend Customizer Modern Designs for Gravity Forms ACF for WooCommerce Product File Manager for Google Drive – Integrate Google Drive Airpress Dynamic Pricing and Discount Rules for WooCommerce Better Messages – Integration for WC Vendors Marketplace Lightbox & Modal Popup WordPress Plugin – FooBox DancePress (TRWA)SKT Templates – 100% Free Templates for Elementor & Gutenberg Advanced Classifieds & Directory Pro ListPlus – Unlimited Listing Directory Ultimate Widgets Light Panorama – 360 Virtual Tour, Panoramic image viewer and More Ultimeter Qyrr – simply and modern QR-Code creation Change Price Title for WooCommerce Checkout with Cash App on EDD SV Tracking Manager Podcast Box – Best Podcasting Plugin for WordPress Elements for LifterLMS Passster – Password Protect Pages and Content Villar Ads.txt & App-ads.txt Manager for WordPress Easy Smooth Scroll Links – Smooth Scrolling Anchor LocalSEOMap WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto Block, Suspend, Report for BuddyPress Add Twitter Pixel for Twitter ads Premmerce Multi-currency for Woocommerce XT Quick View for WooCommerce Primary Addon for Elementor ClimateClick: Climate Action for all Focus on Reviews for WooCommerce Featured Images in RSS for Mailchimp & More SEO Booster Premmerce Product Filter for WooCommerce Book BuyBack Prices WPGSI: Spreadsheet Integration SSL Atlas – Free SSL Certificate & HTTPS Redirect for WordPress WP Group Promoter Fast WordPress Post Snippets – Custom WordPress Code Snippets Customizer Image Alt Text Manager – Bulk & Dynamic Alt Tags For image SEO Optimization + AI Activity Log For MainWP Hasium Blocked in China | Check if your site is available in the Chinese mainland Elasta Featured Products First for WooCommerce – A Extension of WooCommerce (WooCommerce Addon Plugin)Display Eventbrite Events WP Affiliate Disclosure Restaurant & Cafe Addon for Elementor Team Collaboration & Content Workflow Plugin for WordPress Editorial Teams – Multicollab WordPress Animation Plugin – Animated Everything WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan Contact Form 7 Multi-Step Forms Woocommerce Customer Reviews with Artificial Intelligence analyzis, with IBM Watson Tone Analyzer Power Ups for Elementor WP Lead Stream Videopack WordPress Translation plugin for Post, Pages & WooCommerce products. Tranzly IO AI DeepL automatic WordPress Translator.Auto SEO META keywords (META tags keywords) optimization + WooCommerce Bulk Edit Coupons for WooCommerce – WP Sheet Editor WooCommerce PayPlug RW Divi Unite Gallery WP Tools Divi Product Carousel Quick Affiliate Store Premmerce Permalink Manager for WooCommerce Premmerce WooCommerce Customers Manager WP Sessions Time Monitoring Full Automatic WP Dev Powers – Display Screen Dimensions to Admin Plugin Abeta Link PunchOut Scrollsequence – Cinematic Scroll Image Animation Plugin Premmerce Redirect Manager YT Player – Embed and Customize Video Players Premmerce Wholesale Pricing for WooCommerce Delete Duplicate Posts kk Star Ratings – Rate Post & Collect User Feedbacks Delete Posts automatically Drip Feed Content Extended for Learndash Master Blocks – Gutenberg Site Builder Station Pro – Advanced Audio Streaming & Player for WordPress WordPress SEO Checklist Overlay Image Divi Module Ant Admin Notices for Team Amela Super Video player – Fully Customizable Video Player with Playlist WP Conference Schedule Easy Math Captcha for CF7 Opensea XT Ajax Add To Cart for WooCommerce Tiered Pricing Table for WooCommerce Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO)Code Manager Widget for Contact form 7 StoreCustomizer – A plugin to Customize all WooCommerce Pages PopOverXYZ – Show Light Weight Beautiful Tool Tips On Any Text Product Author for WooCommerce Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits Purus Caxton – Create Pro page layouts in Gutenberg Salon Booking System – Free Version WP School Calendar Quick Event Manager WP Meta and Date Remover TopNewsWp – Display Tikcer News, RSS Feed Widget and Many More WordPress Google Translate AFI – The Easiest Integration Plugin VO Store Locator – WP Store Locator Plugin WS Bootstrap Past Events Extension Easy Appointment Booking & Scheduling System – Webba Booking Calendar Multisite Robots.txt Manager WPOptin – AI-Powered Top Bars, PopUps & Lead Generation Blog Designer Pack – Blog, Post Grid, Post Slider, Post Carousel, Category Post, News Share This Image Redirection for Contact Form 7 Education Addon for Elementor Shuban Chat Button- Leads and Order over Chat Automatic YouTube Gallery Genealogical Tree – Family Tree & Ancestry for WordPress WP Frontend Profile Get feedback from visitors – WP Feedback Suite Plugin Internal Link Juicer: SEO Auto Linker for WordPress wGauge – Free Version Viralike SocialMark – Easy Watermark/Logo on Social Media Post Link Share Preview Impexium Single Sign On URL Shortify – Simple and Easy URL Shortener Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent BlockMeister – Block Pattern Builder FAQ Manager For Divi, Gutenberg Block & Shortcode Hooked Editable Content PowerFolio – Portfolio & Image Gallery for Elementor Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player Preloader for Divi Error Log Monitor Live Drag and Drop Builder for Contact Form 7 Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages Premmerce User Roles WordPress Dev Powers – Element Selector jQuery Powers Plugin Divi Gravity Forms (WP Tools)WordPress WooCommerce Sync for Google Sheet Purosa WP Moose WP Activity Log Comments Not Replied To Pledged Plugins Secure Gateway for Authorize.net and WooCommerce WP Table Builder – Drag & Drop Table Builder Advanced Database Replacer EthPress – Web3 Login Tarot Card Oracle GFireM Action After Nokke Change Prices with Time for WooCommerce SnazzyAdmin WP Admin Theme Modern Addons for Elementor Page Builder HuCommerce | Magyar kiegészítések WooCommerce webáruházakhoz Send Prebuilt Emails Alley Business Toolkit Product Attachment for WooCommerce jav's – WooCommerce and Trello integration WooTrello Order and Inventory Manager for WooCommerce Walker Core Premmerce Product Search for WooCommerce Sync eCommerce NEO Ultimate Divi Modules Suite – Divi Sumo Lite WP Books Gallery – Build Stunning Book Showcases & Libraries in Minutes Zip Code Redirect Surbma | GDPR Proof Cookie Consent & Notice Bar Product Options and Price Calculation Formulas for WooCommerce – Uni CPO Product Customer List for WooCommerce Stop Contact Form 7 Spam & WPForms Spam – Free Protection Easy Newsletter Signups Rest Routes – Custom Endpoints for WordPress REST API Bulk Edit Categories and Tags – Create Thousands Quickly on the Editor CP Simple Newsletter Meridia Simple Social Page Widget & Shortcode AidWP – Donation & Payment Forms (Stripe Powered)Multipurpose Gutenberg Block Bulk Edit Posts and Products in Spreadsheet WP Free SSL Streak CRM For Gmail For Contact Form 7 – WordPress Plugin Livemesh SiteOrigin Widgets Run Contests, Raffles, and Giveaways with ContestsWP Frontend Admin – Add and edit posts, pages, users and more all from the frontend Court Reservation – Manage Your Court Bookings Online WordPress Directory Plugin For Business Listings – WP Local Plus Enhanced Ecommerce Google Analytics for WooCommerce Knowledge Base documentation & wiki plugin – BasePress Docs Atlas – Knowledge Base WP Author Bio Ultimate Carousel For Divi Woocommerce Customers Order History Store Toolkit – WooCommerce Extensions, Quick Enhancements & Handy Tools Brand Any Popup – Popup Forms, Optins & Ads Advanced Menu Manager Pro – Built for Content-heavy WordPress Sites to Add, Filter, Lock, and Edit Menus Easily Sticky add to cart for Woo WP Emaily EU VAT Assistant for WooCommerce LittleBot ACH for Stripe + Plaid WPMailer – The best mail builder, No More Core for your emails support Elementor, CF7 forms etc…TwentyFourth WP Scraper Social Kit Buttonizer – Floating Menus, Sticky Buttons, & Popup Builder Fast Checkout for WooCommerce Banner Management, Product Slider, Product Carousel for WooCommerce BlockyPage – Gutenberg Based Page Builder Ethereum Wallet Page Builder for Gutenberg – StarterBlocks GFireM Advance Search Radio Station by netmix® – Manage and play your Show Schedule in WordPress!JDs Portfolio Content Aware Sidebars – Fastest Widget Area Plugin CartPops – High Converting Add To Cart Popup For WooCommerce Builder for WooCommerce product reviews shortcodes – ReviewShort Quick Paypal Payments One Click Login Restrict – membership, site, content and user access restrictions for WordPress Drop Shadow Boxes NicheBase Yatri Tools BAVOKO SEO Tools – All-in-One WordPress SEO Premmerce SEO for WooCommerce RevivePress – Keep your Old Content Evergreen Cartoon Url Block Styler For Gravity Forms Strumenti Partita IVA per Woocommerce SheetPress – Manage WordPress Meta data with Google Sheets Product Size Charts Plugin for WooCommerce Extend Filter Products By Price Widget Easy TikTok Feed – TikTok Video, Feed & Gallery Plugin Post List Designer – Category Post, Recent Post, Post List WP Coupons and Deals – Coupon Plugin For Affiliate Marketers Giveaways for woocommerce Mass Pages/Posts Creator User Menus – Nav Menu Visibility Page Builder Gutenberg Blocks – Kioken Blocks Prime Mover – Migrate WordPress Website & Backups SSL Zen — SSL Certificate Installer & HTTPS Redirects WPBITS Addons For Elementor Page Builder Live TV Player – Worldwide Live TV Channels Player for WordPress Digital Goods (Checkout Field Editor) for WooCommerce Checkout Bani Sky Login Redirect WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes)Connect WooCommerce Shop to ERP/CRM, Verifactu and EU/VAT Compliance WPVisitorInfo – Show Visitor Information & Conditional Data Based On That Information Stackable – Page Builder Gutenberg Blocks Availability Datepicker – Booking Calendar for Contact Form 7 – Input WP Generate Images (AI) – Magic Post Thumbnail Grid & Styler For Contact Form 7 And Divi YASR – Yet Another Star Rating Plugin for WordPress Pay For Post with WooCommerce WP SPID Italia Ether and ERC20 tokens WooCommerce Payment Gateway Restrict User Access – Ultimate Membership & Content Protection Ninja Libs Amazon SES MailChimp Manager Gallery by FooGallery SQL Reporting Services – SSRS Plugin for WordPress Simple Sponsorships Woo Admin Product Notes WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce Product Carousel For WooCommerce – WoorouSell Postcode Redirect Fullscreen Menu Bulk Edit and Create User Profiles – WP Sheet Editor XT Variation Swatches for WooCommerce Document Viewer – Embed Word, Excel, PowerPoint & PDFs Instantly Prime Slider – Addons for Elementor Premmerce Brands for WooCommerce WP Adminify – White Label WordPress, Admin Menu Editor, Login Customizer Joli FAQ SEO – WordPress FAQ Plugin WP Tools Divi Blog Carousel Ultimate Gutenberg – Custom Block Templates Divi Torque Lite – Divi Theme, Divi Builder & Extra Theme CodeKit – Custom Codes Editor APPExperts – Mobile App Builder for WordPress | WooCommerce to iOS and Android Apps FIT: Featured Image Toolkit Connected Sermons Kikote – Location Picker at Checkout & Google Address AutoFill Plugin for WooCommerce Get Directions Map Shared Files – Frontend File Upload Form & Secure File Sharing WP Comment Cleaner – Delete All Comments, Disable Comments, Bulk Delete & Remove Comments Pinblocks — Gutenberg blocks with Pinterest widgets Glorious Services & Support BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages WP Mobile Menu – The Mobile-Friendly Responsive Menu WordPress Reviews by ReviewPress Add Linkedin insight tags for Linkedin ads ConsultPress Lite WP Required Taxonomies – Categories and Tags Mandatory A no-code page builder for beautiful performance-based content Ultimate Bulk SEO Noindex Nofollow – Speed up Penalty Recovery Ultimate SEO Booster Hide Shipping Method For WooCommerce Shipping Method Display Style for WooCommerce Lightbox – EverlightBox Gallery Logo Showcase – Responsive Logo Carousel, Logo Slider & Logo Grid SV Proven Expert Dynific Addons for Elementor (formerly AnyWhere Elementor)Wadi Survey Remove Add to Cart WooCommerce azw woocommerce file uploads Wp My Admin Bar Guestofy – Restaurant Reservations Plugin, Room Planer, Reservation Form GFireM Fields 3D Viewer – Display Interactive 3D Models FeedbackScout: The easiest way to collect, prioritise, manage and track customer feedback.Fraud Prevention For WooCommerce and EDD Cryptocurrency Portfolio Tracker Кнопка ЮMoney Tag Groups is the Advanced Way to Display Your Taxonomy Terms WP Munich Blocks – Gutenberg Blocks for WordPress StreamCast – Live Radio Streaming Player WP AutoMedic W3SCloud Contact Form 7 to Zoho CRM WP Event Partners – WordPress Plugin for Event and Conference Management Food Store – Online Food Delivery & Pickup XT Points & Rewards for WooCommerce Rocket Maintenance Mode & Coming Soon Page Spotlight Social Feeds – Block, Shortcode, and Widget ForceField Forms to Zapier, Integromat, IFTTT, Workato, Automate.io, elastic.io, Built.io, APIANT, Webhook Print My Blog – Print, PDF, & eBook Converter WordPress Plugin RecurWP – WordPress Recurly Payment Gateway Limb Gallery | Create Beautiful Image & Video Galleries Out of stock display for woocommerce Persistent Login Announcement & Notification Banner – Bulletin LearnMore Ivory Search – WordPress Search Plugin Image Photo Gallery Final Tiles Grid Easy Settings for LearnDash WP Radio – Worldwide Online Radio Stations Directory for WordPress Before and After Product Images for WooCommerce Scheduled Notification Bar WoowGallery STAX Header Builder WP-Cron Status Checker Go Viral – social share, social sharebar, social locker, social chat, open graph, reactions, share & view counters Bulk Auto Image Title Attribute (Image Title tag) optimizer (Image SEO)Justified Gallery WPBakery Page Builder Addons by Livemesh Easy Zillow Reviews Tabs with Recommended Posts (Widget)WP Sierra Front End PM WP Frontend Admin – Display WP Admin Pages in the Frontend Email Tracker Performance Kit Email Header Footer WP Post Block Simple Giveaways – Grow your business, email lists and traffic with contests Checkout with Zelle on Woocommerce Thank You Page for WooCommerce MapGeo – Interactive Geo Maps Post to Google My Business (Google Business Profile)WP Link Bio AdFoxly – Ad Manager, AdSense Ads & Ads.txt Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred KRSP Frontend File Uploader Ultimate Blocks – 25+ Gutenberg Blocks for Block Editor Starfish Review Generation & Marketing for WordPress B2B Request a Quote Livemesh Addons by Elementor WP Contact Slider – Contact Form Slider Widget TK SmugMug Slideshow Shortcode Emails Blacklist for Everest Forms Coinbase Commerce – Crypto Gateway for WooCommerce Unlimited Elements For Elementor WooCommerce Variation Swatches for Products WCC SEO Keyword Research RankBear Gift Message for WooCommerce South Pole: Climate action now Widgets on Pages Contact Widgets For Elementor all the contact links you need in one place Security Ninja – WordPress Security & Firewall Product Country Restrictions for WooCommerce – Country Catalogs Gallery PhotoBlocks WordPress Buffer – HYPESocial. Social Media Auto Post, Social Media Auto Publish and Schedule Floating Social Share Icons and Social Share buttons – Next Previous Post Links – FL Sparrow: Product Reviews and Ratings for WooCommerce Live Scores for SportsPress Broadcast Lite Affiliate Link Builder Plugin for Amazon Associates – Review Engine Bulk Edit Products for WooCommerce – WP Sheet Editor Divi Collage Easy Age Verify Disable Payment Methods based on cart conditions for WooCommerce Dashy – Google Analytics advanced dashboard Checkout with Venmo on EDD WP Smart Export (Free)Better Messages – WCFM Integration Advanced Custom Fields options import/export Turbo Widgets Arendelle Extra Fees for WooCommerce

CWE ID-CWE-862

Missing Authorization

CVE-2024-5860

Matching Score-6

Assigner-Wordfence

View Details

Matching Score-6

Assigner-Wordfence

CVSS Score-4.3||MEDIUM

EPSS-0.28% / 20.22%

7 Day CHG~0.00%

Published-18 Jun, 2024 | 03:13

Updated-08 Apr, 2026 | 19:22

Tickera <= 3.5.2.8 - Missing Authorization to Authenticated (Susbcriber+) Ticket Deletion

The Tickera – WordPress Event Ticketing plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the tc_dl_delete_tickets AJAX action in all versions up to, and including, 3.5.2.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete all tickets associated with events.

Vendor-tickera tickera tickera

Product-tickera Tickera – Sell Tickets & Manage Events tickera

CWE ID-CWE-862

Missing Authorization

CWE ID-CWE-863

Incorrect Authorization

CVE-2025-30851

Matching Score-6

Assigner-Patchstack

View Details

Matching Score-6

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.28% / 20.51%

7 Day CHG~0.00%

Published-27 Mar, 2025 | 10:55

Updated-28 Apr, 2026 | 16:11

WordPress Tickera plugin <= 3.5.5.2 - Broken Access Control vulnerability

Vendor-Tickera

Product-Tickera

CWE ID-CWE-862

Missing Authorization

CVE-2025-12356

Matching Score-6

Assigner-Wordfence

View Details

Matching Score-6

Assigner-Wordfence

CVSS Score-4.3||MEDIUM

EPSS-0.24% / 14.90%

7 Day CHG~0.00%

Published-18 Feb, 2026 | 05:29

Updated-08 Apr, 2026 | 17:30

Tickera – WordPress Event Ticketing <= 3.5.6.4 - Missing Authorization to Authenticated (Subscriber+) Event/Post Status Update

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_change_ticket_status' AJAX endpoint in all versions up to, and including, 3.5.6.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update post/event statuses.

Vendor-tickera

Product-Tickera – Sell Tickets & Manage Events

CWE ID-CWE-862

Missing Authorization

CVE-2025-69355

Matching Score-6

Assigner-Patchstack

View Details

Matching Score-6

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.15% / 5.13%

7 Day CHG~0.00%

Published-06 Jan, 2026 | 16:36

Updated-28 Apr, 2026 | 16:14

WordPress Tickera plugin <= 3.5.6.4 - Broken Access Control vulnerability

Vendor-Tickera

Product-Tickera

CWE ID-CWE-862

Missing Authorization

CVE-2024-35659

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-5.3||MEDIUM

EPSS-0.34% / 26.10%

7 Day CHG~0.00%

Published-08 Jun, 2024 | 16:09

Updated-28 Apr, 2026 | 16:09

WordPress KiviCare plugin <= 3.6.6 - Insecure Direct Object References (IDOR) vulnerability

Missing Authorization vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects KiviCare: from n/a through <= 3.6.6.

Vendor-iqonic Iqonic Design

Product-kivicare KiviCare

CWE ID-CWE-862

Missing Authorization

CVE-2024-35717

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.36% / 28.21%

7 Day CHG~0.00%

Published-10 Jun, 2024 | 08:00

Updated-28 Apr, 2026 | 16:09

WordPress Media Slider plugin <= 1.3.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in A WP Life Media Slider – Photo Sleder, Video Slider, Link Slider, Carousal Slideshow.This issue affects Media Slider – Photo Sleder, Video Slider, Link Slider, Carousal Slideshow: from n/a through 1.3.9.

Vendor-A WP Life

Product-media_slider Media Slider – Photo Sleder, Video Slider, Link Slider, Carousal Slideshow

CWE ID-CWE-862

Missing Authorization

CVE-2024-35716

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.29% / 21.72%

7 Day CHG~0.00%

Published-11 Jun, 2024 | 09:19

Updated-28 Apr, 2026 | 16:09

WordPress Copymatic plugin <= 1.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in Copymatic Copymatic – AI Content Writer & Generator.This issue affects Copymatic – AI Content Writer & Generator: from n/a through 1.9.

Vendor-copymatic Copymatic copymatic

Product-copymatic Copymatic – AI Content Writer & Generator copymatic

CWE ID-CWE-862

Missing Authorization

CVE-2026-9017

Matching Score-4

Assigner-Wordfence

View Details

Matching Score-4

Assigner-Wordfence

CVSS Score-5.3||MEDIUM

EPSS-0.27% / 19.46%

7 Day CHG~0.00%

Published-11 Jul, 2026 | 06:50

Updated-15 Jul, 2026 | 14:18

NEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_send_nf_email AJAX Action

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the saved_admin_email, saved_user_email, and saved_user_email_address fields of arbitrary form entries belonging to other users, and cause the site to dispatch attacker-controlled email content to attacker-chosen recipient addresses.

Vendor-webaways

Product-NEX-Forms – Ultimate Forms Plugin for WordPress

CWE ID-CWE-862

Missing Authorization

CVE-2024-35667

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-5.3||MEDIUM

EPSS-0.38% / 30.73%

7 Day CHG~0.00%

Published-11 Jun, 2024 | 14:09

Updated-28 Apr, 2026 | 16:09

WordPress Shopping Cart & eCommerce Store plugin <= 5.5.19 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP EasyCart.This issue affects WP EasyCart: from n/a through 5.5.19.

Vendor-WP EasyCart

Product-WP EasyCart

CWE ID-CWE-862

Missing Authorization

CVE-2024-35725

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.36% / 28.21%

7 Day CHG~0.00%

Published-10 Jun, 2024 | 07:48

Updated-28 Apr, 2026 | 16:09

WordPress LA-Studio Element Kit for Elementor plugin <= 1.3.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in LA-Studio LA-Studio Element Kit for Elementor.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.3.6.

Vendor-la-studioweb LA-Studio

Product-element_kit_for_elementor LA-Studio Element Kit for Elementor

CWE ID-CWE-862

Missing Authorization

CVE-2024-35741

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.30% / 22.12%

7 Day CHG~0.00%

Published-10 Jun, 2024 | 07:41

Updated-28 Apr, 2026 | 16:09

WordPress Awesome Support plugin <= 6.1.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in Awesome Support Team Awesome Support.This issue affects Awesome Support: from n/a through 6.1.7.

Vendor-getawesomesupport Awesome Support Team

Product-awesome_support Awesome Support

CWE ID-CWE-862

Missing Authorization

CVE-2025-68981

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-5.3||MEDIUM

EPSS-0.22% / 12.47%

7 Day CHG~0.00%

Published-30 Dec, 2025 | 10:47

Updated-28 Apr, 2026 | 16:14

WordPress HomeFix Elementor Portfolio plugin <= 1.0.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in designthemes HomeFix Elementor Portfolio homefix-ele-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HomeFix Elementor Portfolio: from n/a through <= 1.0.1.

Vendor-designthemes

Product-HomeFix Elementor Portfolio

CWE ID-CWE-862

Missing Authorization

CVE-2025-68982

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-5.3||MEDIUM

EPSS-0.22% / 12.47%

7 Day CHG~0.00%

Published-30 Dec, 2025 | 10:47

Updated-28 Apr, 2026 | 16:14

WordPress DesignThemes LMS Addon plugin <= 2.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in designthemes DesignThemes LMS Addon designthemes-lms-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DesignThemes LMS Addon: from n/a through <= 2.6.

Vendor-designthemes

Product-DesignThemes LMS Addon

CWE ID-CWE-862

Missing Authorization

CVE-2025-69010

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-5.3||MEDIUM

EPSS-0.21% / 11.93%

7 Day CHG~0.00%

Published-30 Dec, 2025 | 10:47

Updated-28 Apr, 2026 | 20:32

WordPress Themebeez Toolkit plugin <= 1.3.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in themebeez Themebeez Toolkit themebeez-toolkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Themebeez Toolkit: from n/a through <= 1.3.5.

Vendor-themebeez

Product-Themebeez Toolkit

CWE ID-CWE-862

Missing Authorization

CVE-2024-35723

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.33% / 25.75%

7 Day CHG~0.00%

Published-10 Jun, 2024 | 07:50

Updated-28 Apr, 2026 | 16:09

WordPress Dashboard To-Do List plugin <= 1.2.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Andrew Dashboard To-Do List dashboard-to-do-list.This issue affects Dashboard To-Do List: from n/a through <= 1.2.0.

Vendor-arwebdesign Andrew

Product-dashboard_to-do_list Dashboard To-Do List

CWE ID-CWE-862

Missing Authorization

CVE-2024-35748

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-5.3||MEDIUM

EPSS-0.31% / 23.68%

7 Day CHG~0.00%

Published-09 Jun, 2024 | 18:41

Updated-28 Apr, 2026 | 16:09

WordPress WooCommerce Dropshipping plugin <= 5.0.4 - Unauthenticated Arbitrary Email Sending vulnerability

Missing Authorization vulnerability in OPMC WooCommerce Dropshipping.This issue affects WooCommerce Dropshipping: from n/a through 5.0.4.

Vendor-opmc OPMC

Product-woocommerce_dropshipping WooCommerce Dropshipping

CWE ID-CWE-862

Missing Authorization

CVE-2024-35685

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-5.3||MEDIUM

EPSS-0.31% / 23.65%

7 Day CHG~0.00%

Published-11 Jun, 2024 | 10:46

Updated-28 Apr, 2026 | 16:09

WordPress Radcliffe 2 theme <= 2.0.17 - Broken Access Control vulnerability

Missing Authorization vulnerability in Anders Norén Radcliffe 2.This issue affects Radcliffe 2: from n/a through 2.0.17.

Vendor-Anders Norén anders_noren

Product-Radcliffe 2 radcliffe_2

CWE ID-CWE-862

Missing Authorization

CVE-2025-31469

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-5.3||MEDIUM

EPSS-0.29% / 20.79%

7 Day CHG~0.00%

Published-28 Mar, 2025 | 11:54

Updated-28 Apr, 2026 | 16:12

WordPress Clear Sucuri Cache plugin <= 1.4 - Broken Access Control Vulnerability

Missing Authorization vulnerability in webrangers Clear Sucuri Cache clear-sucuri-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clear Sucuri Cache: from n/a through <= 1.4.

Vendor-webrangers

Product-Clear Sucuri Cache

CWE ID-CWE-862

Missing Authorization

CVE-2024-35724

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.32% / 24.69%

7 Day CHG~0.00%

Published-10 Jun, 2024 | 07:49

Updated-28 Apr, 2026 | 16:09

WordPress Bosa Elementor Addons and Templates for WooCommerce plugin <= 1.0.12 - Broken Access Control vulnerability

Missing Authorization vulnerability in Bosa Themes Bosa Elementor Addons and Templates for WooCommerce.This issue affects Bosa Elementor Addons and Templates for WooCommerce: from n/a through 1.0.12.

Vendor-bosathemes Bosa Themes

Product-bosa_elementor_addons_and_templates_for_woocommerce Bosa Elementor Addons and Templates for WooCommerce

CWE ID-CWE-862

Missing Authorization

CVE-2024-35726

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.36% / 28.21%

7 Day CHG~0.00%

Published-10 Jun, 2024 | 07:46

Updated-28 Apr, 2026 | 16:09

WordPress WooBuddy plugin <= 3.4.19 - Broken Access Control vulnerability

Missing Authorization vulnerability in ThemeKraft WooBuddy.This issue affects WooBuddy: from n/a through 3.4.19.

Vendor-themekraft ThemeKraft

Product-buddypress_woocommerce_my_account_integration._create_woocommerce_member_pages WooBuddy

CWE ID-CWE-862

Missing Authorization

CVE-2024-35720

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.36% / 28.21%

7 Day CHG~0.00%

Published-10 Jun, 2024 | 07:59

Updated-28 Apr, 2026 | 16:09

WordPress Album Gallery – WordPress Gallery plugin <= 1.5.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in A WP Life Album Gallery – WordPress Gallery.This issue affects Album Gallery – WordPress Gallery: from n/a through 1.5.7.

Vendor-A WP Life

Product-album_gallery Album Gallery – WordPress Gallery

CWE ID-CWE-862

Missing Authorization

CVE-2024-35661

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-5.3||MEDIUM

EPSS-0.36% / 29.12%

7 Day CHG~0.00%

Published-09 Jun, 2024 | 18:33

Updated-28 Apr, 2026 | 16:09

WordPress Upload Fields for WPForms plugin <= 1.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in SoftLab Upload Fields for WPForms.This issue affects Upload Fields for WPForms: from n/a through 1.0.2.

Vendor-softlabbd SoftLab

Product-upload_fields_for_wpforms Upload Fields for WPForms

CWE ID-CWE-862

Missing Authorization

CVE-2024-35722

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.36% / 28.21%

7 Day CHG~0.00%

Published-10 Jun, 2024 | 07:56

Updated-28 Apr, 2026 | 16:09

WordPress Slider Responsive Slideshow – Image slider, Gallery slideshow plugin <= 1.4.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in A WP Life Slider Responsive Slideshow – Image slider, Gallery slideshow.This issue affects Slider Responsive Slideshow – Image slider, Gallery slideshow: from n/a through 1.4.0.

Vendor-A WP Life

Product-slider_responsive_slideshow Slider Responsive Slideshow – Image slider, Gallery slideshow

CWE ID-CWE-862

Missing Authorization

CVE-2024-35683

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-5.3||MEDIUM

EPSS-0.38% / 30.72%

7 Day CHG~0.00%

Published-11 Jun, 2024 | 13:39

Updated-28 Apr, 2026 | 16:09

WordPress Leyka plugin <= 3.31.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Teplitsa of social technologies Leyka.This issue affects Leyka: from n/a through 3.31.1.

Vendor-Teplitsa of social technologies

Product-Leyka

CWE ID-CWE-862

Missing Authorization

CVE-2024-35692

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-5.3||MEDIUM

EPSS-0.28% / 20.07%

7 Day CHG~0.00%

Published-11 Jun, 2024 | 09:21

Updated-28 Apr, 2026 | 16:09

WordPress GDPR/CCPA Cookie Consent Banner plugin <= 3.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Termly Cookie Consent.This issue affects Cookie Consent: from n/a through 3.2.

Vendor-termly Termly termly

Product-gdpr_cookie_consent_banner Cookie Consent gdpr_cookie_consent_banner

CWE ID-CWE-862

Missing Authorization

CVE-2024-35721

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.36% / 28.21%

7 Day CHG~0.00%

Published-10 Jun, 2024 | 07:57

Updated-28 Apr, 2026 | 16:09

WordPress Image Gallery plugin <= 1.4.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in A WP Life Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery.This issue affects Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery: from n/a through 1.4.5.

Vendor-A WP Life

Product-image_gallery Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery

CWE ID-CWE-862

Missing Authorization

CVE-2024-35674

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.37% / 29.27%

7 Day CHG~0.00%

Published-05 Jun, 2024 | 16:19

Updated-11 May, 2026 | 21:02

WordPress Unlimited Elements For Elementor plugin <= 1.5.109 - Broken Access Control vulnerability

Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through <= 1.5.109.

Vendor-unlimited-elements Unlimited Elements unlimited-elements

Product-unlimited_elements_for_elementor Unlimited Elements For Elementor (Free Widgets, Addons, Templates)unlimited_elements_for_elementor_\(free_widgets\,_addons\,_templates\)

CWE ID-CWE-862

Missing Authorization

CVE-2024-3599

Matching Score-4

Assigner-Wordfence

View Details

Matching Score-4

Assigner-Wordfence

CVSS Score-5.3||MEDIUM

EPSS-0.53% / 41.63%

7 Day CHG~0.00%

Published-02 May, 2024 | 16:52

Updated-08 Apr, 2026 | 18:21

WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) <= 3.0.2 - Missing Authorization to Unauthenticated Arbitrary Post Deletion

The WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the gdpr_policy_process_delete() function in all versions up to, and including, 3.0.2. This makes it possible for unauthenticated attackers to delete arbitrary posts.

Vendor-wpeka wplegalpages

Product-wp_cookie_consent Cookie Banner for GDPR / CCPA – WPLP Cookie Consent

CWE ID-CWE-862

Missing Authorization

CVE-2024-35662

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-5.4||MEDIUM

EPSS-0.35% / 27.69%

7 Day CHG~0.00%

Published-09 Jun, 2024 | 18:31

Updated-28 Apr, 2026 | 16:09

WordPress Simple COD Fees for WooCommerce plugin <= 2.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Andreas Sofantzis Simple COD Fees for WooCommerce.This issue affects Simple COD Fees for WooCommerce: from n/a through 2.0.2.

Vendor-83pixel Andreas Sofantzis

Product-simple_cod_fees_for_woocommerce Simple COD Fees for WooCommerce

CWE ID-CWE-862

Missing Authorization

CVE-2024-35727

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.32% / 24.69%

7 Day CHG~0.00%

Published-10 Jun, 2024 | 07:45

Updated-28 Apr, 2026 | 16:09

WordPress Extra Product Options for WooCommerce plugin <= 3.0.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in actpro Extra Product Options for WooCommerce.This issue affects Extra Product Options for WooCommerce: from n/a through 3.0.6.

Vendor-actpro actpro

Product-extra_product_options_for_woocommerce Extra Product Options for WooCommerce

CWE ID-CWE-862

Missing Authorization

CVE-2024-34435

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.32% / 24.68%

7 Day CHG~0.00%

Published-09 Jun, 2024 | 11:57

Updated-28 Apr, 2026 | 16:09

WordPress Aiomatic plugin <= 1.9.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in CodeRevolution Aiomatic.This issue affects Aiomatic: from n/a through 1.9.3.

Vendor-coderevolution CodeRevolution

Product-aiomatic Aiomatic

CWE ID-CWE-862

Missing Authorization

CVE-2024-34753

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-5.3||MEDIUM

EPSS-0.34% / 26.41%

7 Day CHG~0.00%

Published-11 Jun, 2024 | 16:01

Updated-28 Apr, 2026 | 16:09

WordPress Radio Player plugin <= 2.0.73 - Broken Access Control vulnerability

Missing Authorization vulnerability in SoftLab Radio Player.This issue affects Radio Player: from n/a through 2.0.73.

Vendor-softlabbd SoftLab softlab

Product-radio_player Radio Player radio_player

CWE ID-CWE-862

Missing Authorization

CVE-2025-30929

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-5.3||MEDIUM

EPSS-0.21% / 11.53%

7 Day CHG~0.00%

Published-04 Jul, 2025 | 08:42

Updated-28 Apr, 2026 | 16:12

WordPress fluXtore plugin <= 1.6.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in amazewp fluXtore fluxtore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects fluXtore: from n/a through <= 1.6.0.

Vendor-amazewp

Product-fluXtore

CWE ID-CWE-862

Missing Authorization

CVE-2024-34799

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.37% / 29.37%

7 Day CHG~0.00%

Published-11 Jun, 2024 | 16:35

Updated-28 Apr, 2026 | 16:09

WordPress BookingPress plugin <= 1.0.82 - Appointment Duration Manipulation vulnerability

Missing Authorization vulnerability in Repute Infosystems BookingPress.This issue affects BookingPress: from n/a through 1.0.82.

Vendor-reputeinfosystems Repute Infosystems

Product-bookingpress BookingPress

CWE ID-CWE-862

Missing Authorization

CVE-2024-35174

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-5.3||MEDIUM

EPSS-0.33% / 25.19%

7 Day CHG~0.00%

Published-17 May, 2024 | 10:18

Updated-28 Apr, 2026 | 16:09

WordPress Flo Forms plugin <= 1.0.42 - Broken Access Control vulnerability

Missing Authorization vulnerability in Flothemes Flo Forms.This issue affects Flo Forms: from n/a through 1.0.42.

Vendor-Flothemes flothemes

Product-Flo Forms flo_forms

CWE ID-CWE-862

Missing Authorization

CVE-2025-31000

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-5.3||MEDIUM

EPSS-0.27% / 19.41%

7 Day CHG~0.00%

Published-06 Jun, 2025 | 12:53

Updated-28 Apr, 2026 | 16:12

WordPress Payment QR WooCommerce plugin <= 1.1.6 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Miguel Fuentes Payment QR WooCommerce payment-qr-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment QR WooCommerce: from n/a through <= 1.1.6.

Vendor-Miguel Fuentes

Product-Payment QR WooCommerce

CWE ID-CWE-862

Missing Authorization

CVE-2024-34819

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-5.3||MEDIUM

EPSS-0.41% / 33.45%

7 Day CHG~0.00%

Published-11 Jun, 2024 | 16:10

Updated-28 Apr, 2026 | 16:09

WordPress MC Woocommerce Wishlist plugin <= 1.7.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Moreconvert Team MC Woocommerce Wishlist smart-wishlist-for-more-convert.This issue affects MC Woocommerce Wishlist: from n/a through <= 1.7.2.

Vendor-moreconvert Moreconvert Team moreconvert

Product-woocommerce_wishlist MC Woocommerce Wishlist woocommerce_wishlist

CWE ID-CWE-862

Missing Authorization

CVE-2025-6993

Matching Score-4

Assigner-Wordfence

View Details

Matching Score-4

Assigner-Wordfence

CVSS Score-7.5||HIGH

EPSS-0.44% / 36.15%

7 Day CHG~0.00%

Published-16 Jul, 2025 | 09:22

Updated-02 Aug, 2025 | 01:29

Ultimate WP Mail 1.0.17 - 1.3.6 - Missing Authorization to Authenticated (Contributor+) Privilege Escalation via get_email_log_details Function

The Ultimate WP Mail plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization within the get_email_log_details() AJAX handler in versions 1.0.17 to 1.3.6. The handler reads the client-supplied post_id and retrieves the corresponding email log post content (including the password-reset link), relying only on the ‘edit_posts’ capability without restricting to administrators or validating ownership. This makes it possible for authenticated attackers, with Contributor-level access and above, to harvest an admin’s reset link and elevate their privileges to administrator.

Vendor-rustaurius rustaurius

Product-ultimate_wp_mail Ultimate WP Mail

CWE ID-CWE-862

Missing Authorization

CVE-2024-34763

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-5.3||MEDIUM

EPSS-0.37% / 29.32%

7 Day CHG~0.00%

Published-11 Jun, 2024 | 16:57

Updated-28 Apr, 2026 | 16:09

WordPress Builder for WooCommerce reviews shortcodes – ReviewShort plugin <= 1.01.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in Saleswonder Team: Tobias Builder for WooCommerce reviews shortcodes – ReviewShort woo-product-reviews-shortcode.This issue affects Builder for WooCommerce reviews shortcodes – ReviewShort: from n/a through <= 1.01.5.

Vendor-Saleswonder Team: Tobias

Product-Builder for WooCommerce reviews shortcodes – ReviewShort

CWE ID-CWE-862

Missing Authorization

CVE-2025-30934

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-5.3||MEDIUM

EPSS-0.26% / 17.31%

7 Day CHG~0.00%

Published-06 Jun, 2025 | 12:54

Updated-28 Apr, 2026 | 16:12

WordPress 診断ジェネレータ作成プラグイン plugin <= 1.4.16 - Broken Access Control Vulnerability

Missing Authorization vulnerability in OLIVESYSTEM 診断ジェネレータ作成プラグイン os-diagnosis-generator allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects 診断ジェネレータ作成プラグイン: from n/a through <= 1.4.16.

Vendor-OLIVESYSTEM

Product-診断ジェネレータ作成プラグイン

CWE ID-CWE-862

Missing Authorization

CVE-2024-34822

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-5.3||MEDIUM

EPSS-0.38% / 30.72%

7 Day CHG~0.00%

Published-11 Jun, 2024 | 15:26

Updated-28 Apr, 2026 | 16:09

WordPress weMail plugin <= 1.14.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in weDevs weMail.This issue affects weMail: from n/a through 1.14.2.

Vendor-weDevs Pte. Ltd.

Product-wemail weMail

CWE ID-CWE-862

Missing Authorization

CVE-2026-9021

Matching Score-4

Assigner-Wordfence

View Details

Matching Score-4

Assigner-Wordfence

CVSS Score-5.3||MEDIUM

EPSS-0.30% / 21.93%

7 Day CHG~0.00%

Published-09 Jul, 2026 | 09:31

Updated-09 Jul, 2026 | 16:19

Easy Invoice <= 2.1.19 - Unauthenticated Arbitrary Quote Accept/Decline and Invoice Creation via easy_invoice_accept_quote / easy_invoice_decline_quote AJAX Actions

The Easy Invoice plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.19. This is due to the plugin registering the easy_invoice_accept_quote and easy_invoice_decline_quote AJAX actions via wp_ajax_nopriv_ hooks and relying solely on a quote-scoped nonce that is rendered into the publicly accessible single quote template, combined with an ownership check that is gated behind an off-by-default Pro option (easy_invoice_pro_restrict_quote_to_client). This makes it possible for unauthenticated attackers to accept or decline arbitrary published quotes — and, depending on the configured accept action, automatically convert them into invoices (and even email them to the client) — by harvesting the per-quote nonce from the public quote page and submitting it to admin-ajax.

Vendor-matrixaddons

Product-Easy Invoice – Invoice Generator, PDF Quotes & Payments

CWE ID-CWE-862

Missing Authorization

CVE-2026-9028

Matching Score-4

Assigner-Wordfence

View Details

Matching Score-4

Assigner-Wordfence

CVSS Score-5.3||MEDIUM

EPSS-0.29% / 21.05%

7 Day CHG~0.00%

Published-09 Jul, 2026 | 09:31

Updated-09 Jul, 2026 | 16:19

CorvusPay WooCommerce Payment Gateway <= 2.7.4 - Missing Authorization to Unauthenticated Arbitrary Order Cancellation via 'order_number' Parameter

The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.7.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to cancel any WooCommerce order placed via the CorvusPay payment method by supplying an arbitrary order number to the /wp-json/corvuspay/cancel/ REST endpoint.

Vendor-corvusinfo

Product-CorvusPay WooCommerce Payment Gateway

CWE ID-CWE-862

Missing Authorization

CVE-2024-34768

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-5.3||MEDIUM

EPSS-0.36% / 28.99%

7 Day CHG~0.00%

Published-11 Jun, 2024 | 16:42

Updated-28 Apr, 2026 | 16:09

WordPress Fastly plugin <= 1.2.25 - Broken Access Control vulnerability

Missing Authorization vulnerability in Fastly.This issue affects Fastly: from n/a through 1.2.25.

Vendor-Fastly

Product-Fastly

CWE ID-CWE-862

Missing Authorization

CVE-2024-34802

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-5.3||MEDIUM

EPSS-0.34% / 26.95%

7 Day CHG~0.00%

Published-09 Jun, 2024 | 18:35

Updated-28 Apr, 2026 | 16:09

WordPress AdFoxly plugin <= 1.8.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in AdFoxly AdFoxly – Ad Manager, AdSense Ads & Ads.Txt.This issue affects AdFoxly – Ad Manager, AdSense Ads & Ads.Txt: from n/a through 1.8.5.

Vendor-WP FOXLY

Product-adfoxly AdFoxly – Ad Manager, AdSense Ads & Ads.txt adfoxly

CWE ID-CWE-862

Missing Authorization

CVE-2024-33595

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-4.3||MEDIUM

EPSS-0.45% / 36.92%

7 Day CHG~0.00%

Published-29 Apr, 2024 | 09:16

Updated-28 Apr, 2026 | 16:09

WordPress Master Addons for Elementor plugin <= 2.0.5.4.1 - Broken Access Control on Duplicate Post vulnerability

Missing Authorization vulnerability in Jewel Theme Master Addons for Elementor.This issue affects Master Addons for Elementor: from n/a through 2.0.5.4.1.

Vendor-master-addons Jewel Theme

Product-master_addons Master Addons for Elementor

CWE ID-CWE-862

Missing Authorization

CVE-2015-10140

Matching Score-4

Assigner-WPScan

View Details

Matching Score-4

Assigner-WPScan

CVSS Score-8.8||HIGH

EPSS-0.98% / 58.70%

7 Day CHG~0.00%

Published-22 Jul, 2025 | 13:20

Updated-09 Jan, 2026 | 21:16

Ajax Load More < 2.8.1.2 - Subscriber+ File Upload & Deletion

The Ajax Load More plugin before 2.8.1.2 does not have authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber, to upload and delete arbitrary files.

Vendor-connekthq Unknown

Product-ajax_load_more Ajax Load More

CWE ID-CWE-862

Missing Authorization

CVE-2024-33908

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-5.3||MEDIUM

EPSS-0.40% / 33.11%

7 Day CHG~0.00%

Published-06 May, 2024 | 19:15

Updated-28 Apr, 2026 | 16:09

WordPress WidgetKit plugin <= 2.5.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Themesgrove WidgetKit.This issue affects WidgetKit: from n/a through 2.5.0.

Vendor-Themesgrove

Product-WidgetKit

CWE ID-CWE-862

Missing Authorization

CVE-2024-35729

Credits

WordPress Tickera plugin <= 3.5.2.6 - Broken Access Control vulnerability

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Affected

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs