A security vulnerability in Missing Authorization vulnerability in onOffice GmbH onOffice for WP-Websites (CVSS 5.4). Remediation should follow standard vulnerability management procedures.
Broken access control in Activity Plus Reloaded for BuddyPress up to version 1.1.2 allows authenticated attackers with low privileges to modify activity data or perform unauthorized actions. The vulnerability is due to missing authorization checks (CWE-862) and has a low EPSS score (0.07%), with no public exploit or active exploitation reported.
Missing authorization vulnerability in WP Compress for MainWP allows authenticated attackers with low privileges to exploit incorrectly configured access control security levels, potentially leading to unauthorized modification of settings or data. The issue affects versions through 6.30.32 and has a low EPSS score of 0.07%, with no public exploit or active exploitation confirmed.
Missing authorization in the WordPress Accessibility Suite plugin up to version 4.19 allows authenticated attackers with low privileges to exploit incorrectly configured access controls, leading to unauthorized modification of settings or data. The vulnerability has a CVSS score of 5.4 (medium) and a low EPSS probability of 0.07%, with no evidence of active exploitation or public exploit code.
CVE-2025-29013 is a security vulnerability (CVSS 5.4). Remediation should follow standard vulnerability management procedures.
Missing authorization check in Elastic Email Subscribe Form for WordPress up to version 1.2.2 allows authenticated low-privilege users to modify plugin settings or data, leading to limited integrity and availability impacts. No confidentiality loss, and EPSS indicates very low exploitation likelihood. No active exploitation reported.
Missing authorization vulnerability in No Spam At All WordPress plugin up to version 1.3 allows authenticated attackers with low privileges to exploit incorrectly configured access controls, leading to unauthorized modification of plugin settings or data. No public exploit or active exploitation has been identified, and EPSS score is low (0.07%).
A security vulnerability in Missing Authorization vulnerability in codelobster Responsive Flipbooks (CVSS 5.4). Remediation should follow standard vulnerability management procedures.
A remote code execution vulnerability (CVSS 5.4). Remediation should follow standard vulnerability management procedures.
Missing authorization in Responsive Plus WordPress plugin up to version 3.2.0 allows authenticated attackers with low privileges to exploit incorrectly configured access controls, leading to unauthorized modification of settings or content. No public exploit or active exploitation has been identified, and the EPSS score is low (0.07%).
Server-Side Request Forgery (SSRF) in SmartDataSoft Car Repair Services WordPress theme up to version 5.0 allows unauthenticated attackers to coerce the server into making arbitrary requests, potentially leading to internal network scanning or data exfiltration. This issue carries a CVSS 5.4 score with changed scope, but exploitation is hindered by high attack complexity. No active exploitation or public exploit code has been identified at time of analysis.
Cross-Site Request Forgery in Hive Support WordPress plugin up to version 1.2.2 allows unauthenticated attackers to modify AI/chat settings, including API keys, by tricking a site administrator into clicking a malicious link. No public exploit or active exploitation identified, and EPSS score is low (0.03%).
Cross-Site Request Forgery in the Anti-Spam: Spam Protection plugin for WordPress allows unauthenticated attackers to delete pending comments and re-enable blocked users by tricking a site administrator into clicking a malicious link. The vulnerability affects all versions up to and including 2024.7 due to missing nonce validation in specific files. No public exploit or active exploitation has been identified, and the EPSS score is low at 0.03%.
Cross-Site Request Forgery (CSRF) in Print Invoice & Delivery Notes for WooCommerce up to version 5.5.0 allows an attacker to perform unauthorized actions on behalf of an authenticated admin, such as modifying invoice templates or delivery notes. The vulnerability requires user interaction (clicking a crafted link) and has a low EPSS score (0.03%), indicating low exploitation likelihood. No public exploit or active exploitation has been reported.
Cross-Site Request Forgery (CSRF) in Elite Video Player for WordPress allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying settings or deleting data. The vulnerability affects versions up to and including 10.0.5. No public exploit or active exploitation has been identified, and the EPSS score is low (0.03%).
Cross-Site Request Forgery (CSRF) in Advanced Post List WordPress plugin up to version 0.5.6.2 allows an attacker to trick an authenticated admin into performing unintended actions, such as modifying plugin settings or deleting data, by luring them to a malicious page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.03%).
A Cross-Site Request Forgery vulnerability in the Global Translator WordPress plugin through version 2.0.2 allows attackers to perform unauthorized actions on behalf of authenticated users, potentially modifying plugin settings or disrupting service. Exploitation requires an administrator to visit a malicious website while logged in. No public exploit code or active exploitation has been identified.
Cross-Site Request Forgery (CSRF) in Pay with Contact Form 7 plugin for WordPress allows an attacker to trick an authenticated admin into performing unintended actions, such as modifying plugin settings or initiating unauthorized transactions. Affected versions are through 1.0.4. No public exploit or active exploitation has been identified, and EPSS score is low (0.03%).
Code injection vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and executing certain commands that can be executed with view permission.
A remote code execution vulnerability in IDF (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
A security vulnerability in for WordPress is vulnerable to Full Path Disclosure in all (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
Sensitive information exposure in the Crawlomatic Multisite Scraper Post Generator WordPress plugin through version 2.6.8.2 allows unauthenticated remote attackers to retrieve embedded sensitive data via transmitted responses, due to insertion of sensitive information into sent data. No authentication or user interaction is required, but only low-impact confidentiality is compromised. No active exploitation or public exploit is known at time of analysis (EPSS 0.07%).
Sensitive data exposure in KI Live Video Conferences WordPress plugin up to version 5.5.15 allows unauthenticated remote attackers to retrieve embedded sensitive data. The vulnerability has a low EPSS score (0.07%) and no public exploit or active exploitation has been identified.
Missing authorization in the WordPress plugin Interactive Regional Map of Florida up to version 1.0 allows unauthenticated attackers to modify plugin settings or data due to broken access controls. The vulnerability has a low EPSS score (0.06%) and no public exploit or active exploitation has been identified.
Missing authorization in Job Board Manager WordPress plugin up to version 2.1.60 allows unauthenticated attackers to exploit incorrectly configured access controls, potentially modifying data without authentication. No public exploit or active exploitation has been identified, and EPSS score is low (0.06%).
A remote code execution vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
Missing authorization in WP-CRM System up to version 3.4.2 allows unauthenticated attackers to access functionality not properly constrained by ACLs, potentially leading to unauthorized data access or modification. No public exploit or active exploitation has been identified, and EPSS score is low (0.06%).
Missing authorization in Verge3D WordPress plugin up to version 4.9.4 allows unauthenticated attackers to exploit incorrectly configured access controls, leading to low confidentiality impact. No public exploit or active exploitation identified; EPSS score is low (0.06%).
A security vulnerability in Missing Authorization vulnerability in bobbingwide oik (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
A security vulnerability in raychat Raychat allows Accessing Functionality Not Properly Constrained by ACLs (CVSS 5.3) that allows accessing functionality not properly constrained. Remediation should follow standard vulnerability management procedures.
Missing authorization in Payment QR WooCommerce plugin for WordPress allows unauthenticated attackers to modify payment QR settings without proper access control. Affects versions up to 1.1.6. No public exploit or active exploitation identified, and EPSS score is low (0.06%).
A security vulnerability in Missing Authorization vulnerability in taskbuilder Taskbuilder (CVSS 5.3) that allows accessing functionality not properly constrained. Remediation should follow standard vulnerability management procedures.
Missing authorization in the OS Diagnosis Generator WordPress plugin up to version 1.4.16 allows unauthenticated remote attackers to access and modify plugin functionality that is not properly constrained by access controls, leading to low-impact integrity compromise.
A remote code execution vulnerability (CVSS 5.3) that allows accessing functionality not properly constrained. Remediation should follow standard vulnerability management procedures.
Missing authorization in WP AutoKeyword 1.0 allows unauthenticated attackers to exploit incorrectly configured access controls, potentially modifying settings or data without proper permissions. No public exploit or active exploitation has been identified, and EPSS score is low (0.06%).
A security vulnerability in Missing Authorization vulnerability in viralloops Viral Loops WP Integration (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
Missing authorization in bbPress API plugin for WordPress allows unauthenticated attackers to access sensitive data. The plugin versions up to 1.0.14 fail to properly enforce access controls on API endpoints, leading to potential information disclosure. No public exploit or active exploitation has been identified at this time.
A security vulnerability in Missing Authorization vulnerability in whassan KI Live Video Conferences (CVSS 5.3). Remediation should follow standard vulnerability management procedures.
Missing authorization in QuickCab WordPress plugin up to version 1.3.3 allows unauthenticated attackers to modify settings or access restricted functionality. The vulnerability has a low EPSS score (0.06%) and no public exploit or active exploitation has been reported.
Stored Cross-Site Scripting (XSS) vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious JavaScript payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and executing certain commands that can be executed with view permission.
Code injection vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and executing certain commands that can be executed only with permissions higher than the view permission.
A remote code execution vulnerability in IDF (CVSS 5.1). Remediation should follow standard vulnerability management procedures.
The wallet has an authentication bypass vulnerability that allows access to specific pages.
A security vulnerability in add-ons (CVSS 5.0). Remediation should follow standard vulnerability management procedures.
A flaw was found in Samba. The smbd service daemon does not pick up group membership changes when re-authenticating an expired SMB session. This issue can expose file shares until clients disconnect and then connect again.
The Simple History plugin for WordPress is vulnerable to sensitive data exposure via Detective Mode due to improper sanitization within the append_debug_info_to_context() function in versions prior to 5.8.1. When Detective Mode is enabled, the plugin’s logger captures the entire contents of $_POST (and sometimes raw request bodies or $_GET) without redacting any password‐related keys. As a result, whenever a user submits a login form, whether via native wp_login or a third‐party login widget, their actual password is written in clear text into the logs. An authenticated attacker or any user whose actions generate a login event will have their password recorded; an administrator (or anyone with database read access) can then read those logs and retrieve every captured password.
The WP Online Users Stats plugin for WordPress is vulnerable to time-based SQL Injection via the ‘table_name’ parameter in all versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Server-Side Request Forgery (SSRF) in Nexa Blocks WordPress plugin up to version 1.1.0 allows authenticated attackers with low privileges to make the server send crafted requests to internal or external resources. This can lead to limited information disclosure or limited impact on internal systems. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Server-Side Request Forgery (SSRF) in SocialMark WordPress plugin up to version 2.0.7 allows authenticated attackers with low privileges to make the server send crafted requests to internal or external resources, potentially leading to limited information disclosure or low-impact manipulation of internal services. No public exploit or active exploitation has been identified, and the EPSS score is low (0.04%).
Stored Cross-Site Scripting (XSS) vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious JavaScript payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and executing certain commands that can only be executed with permissions higher than the view permission.