CVE Vulnerability Catalog

The WEDOS Global plugin for WordPress has a missing authorization vulnerability that allows accessing functionality not properly constrained by ACLs. This issue affects versions from n/a through 1.2.2.

The Yext plugin in versions up to 1.1.3 contains a Missing Authorization vulnerability, allowing access to functionality not properly constrained by ACLs.

The Delisho (dr-widgets-blocks) plugin for WordPress in versions up to and including 1.1.3 contains a Missing Authorization vulnerability. It allows exploitation of incorrectly configured access control security levels.

The CopySafe Web Protection plugin (versions up to 5.1) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. Attackers can access functions without proper permissions.

Insertion of Sensitive Information Into Sent Data vulnerability in themelooks FoodBook allows retrieving embedded sensitive data. This issue affects FoodBook from n/a through <= 4.7.6.

The Simple Colorbox WordPress plugin contains a Stored Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. The issue affects versions up to and including 1.6.1.

The HivePress Claim Listings plugin for WordPress in versions up to and including 1.1.3 contains a Missing Authorization vulnerability. It enables exploitation of incorrectly configured access control security levels.

The HivePress Claim Listings plugin for WordPress in versions up to and including 1.1.4 contains a Missing Authorization vulnerability. It allows exploitation of incorrectly configured access control security levels.

The WooEvents plugin for WordPress has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 4.1.7.

The WP Directory Kit plugin (versions up to 1.4.0) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. Attackers can access functions without proper permissions.

The CoSchedule plugin (versions up to and including 3.3.11) exposes sensitive system information to an unauthorized control sphere. This allows retrieval of embedded sensitive data.

CSRF vulnerability in the Vehica Core. An attacker can exploit this to perform unauthorized actions in the admin panel.

The Grand Conference Theme Custom Post Type plugin (versions up to 2.6.4) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. Attackers can access functions without proper permissions.

CSRF vulnerability in the Instapage plugin. Allows an attacker to perform unauthorized requests on behalf of an administrator.

The YayCurrency plugin for WordPress (versions up to and including 3.3.1) contains a Code Injection vulnerability caused by improper control of code generation. An attacker can inject and execute arbitrary code within the application context.

CSRF vulnerability in the Groovy Menu plugin. An attacker can exploit this to perform unauthorized operations in the admin context.

The aThemes Addons for Elementor plugin contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through 1.1.2.

The EmailKit plugin by Roxnor has a missing authorization vulnerability. It allows exploiting incorrectly configured access control security levels. The issue affects EmailKit from n/a through <= 1.6.0.

The Ditty plugin contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through 3.1.58.

The WordPress plugin Gallery Custom Links (versions up to 2.2.5) has a Stored XSS vulnerability due to improper input neutralization during web page generation.