CVE Vulnerability Catalog

The Litho Addons plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 3.5.

The WP EasyCart plugin from levelfourdevelopment is vulnerable to insertion of sensitive information into sent data, allowing retrieval of embedded sensitive data. This affects versions up to and including 5.8.11.

The Custom Layouts – Post + Product grids made easy plugin by Code Amp contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 1.4.12.

The MultiParcels Shipping For WooCommerce plugin up to version 1.30.12 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

Vulnerability in the WP AI CoPilot plugin allows insertion of sensitive information into sent data, enabling an attacker to retrieve embedded sensitive data.

The Notification for Telegram plugin up to version 3.5.1 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

CSRF vulnerability in the WP Flashy Marketing Automation WordPress plugin allows an attacker to perform unauthorized requests on behalf of a logged-in administrator. Affects versions up to and including 2.0.8.

CSRF vulnerability in the Social Photo Fetcher WordPress plugin allows an attacker to perform unauthorized requests on behalf of a logged-in user. Affects versions up to and including 3.0.4.

The Just TinyMCE Custom Styles plugin (up to version 1.2.1) is vulnerable to Cross-Site Request Forgery (CSRF). An attacker can force an authenticated user to perform unwanted actions.

The Eupago Gateway For Woocommerce plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 4.7.1.

The WordPress plugin Gravitec.net – Web Push Notifications (gravitec-net-web-push-notifications) contains a Missing Authorization vulnerability due to incorrectly configured access control security levels. The issue affects versions up to and including 2.9.17.

The Ergonet Cache plugin from ergonet is vulnerable to missing authorization, allowing exploitation of incorrectly configured access control security levels. This affects versions up to and including 1.0.13.

CSRF vulnerability in the Auto Alt Text WordPress plugin allows an attacker to perform unauthorized requests on behalf of a logged-in administrator. Affects versions up to and including 2.5.2.

Missing Authorization vulnerability in Evan Herman Post Cloner post-cloner allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post Cloner: from n/a through <= 1.0.0.

CSRF vulnerability in the SMTP Mail WordPress plugin allows an attacker to perform unauthorized requests on behalf of a logged-in administrator. Affects versions up to and including 1.3.51.

The WP-CRM System contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 3.4.6.

The Add Custom Codes plugin (by SaifuMak) is vulnerable to Cross-Site Request Forgery (CSRF). This issue affects Add Custom Codes versions from n/a through <= 4.80.

Formstack Online Forms plugin (versions up to 2.0.2) has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthenticated user can perform actions they are not permitted to.

A vulnerability in the Image Cleanup plugin (opicron) allows exposure of sensitive system information to unauthorized parties. The issue affects versions up to and including 1.9.2.

The Image Cleanup plugin up to version 1.9.2 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.