Vulnerabilities > Authorization Bypass Through User-Controlled Key

DATE	CVE	VULNERABILITY TITLE	RISK
2024-12-31	CVE-2024-13040	The QOCA aim from Quanta Computer has an Authorization Bypass Through User-Controlled Key vulnerability. network low complexity CWE-639	8.8
2024-12-25	CVE-2024-12335	The Avada (Fusion) Builder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.11.12 via the handle_clone_post() function and the 'fusion_blog' shortcode and due to insufficient restrictions on which posts can be included. network low complexity CWE-639	4.3
2024-12-24	CVE-2024-12103	The Content No Cache: prevent specific content from being cached plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 0.1.2 via the eos_dyn_get_content action due to insufficient restrictions on which posts can be included. network low complexity CWE-639	5.3
2024-12-21	CVE-2024-10797	The Full Screen Menu for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.7 via the Full Screen Menu Elementor Widget due to insufficient restrictions on which posts can be included. network low complexity CWE-639	4.3
2024-12-18	CVE-2024-12061	The Events Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.3 via the naevents_elementor_template shortcode due to insufficient restrictions on which posts can be included. network low complexity CWE-639	4.3
2024-12-17	CVE-2024-9819	Authorization Bypass Through User-Controlled Key vulnerability in NextGeography NG Analyser allows Functionality Misuse.This issue affects NG Analyser: before 2.2.711. network low complexity CWE-639	6.5
2024-12-14	CVE-2024-10690	The Shortcodes for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.4 via the 'SHORTCODE_ELEMENTOR' shortcode due to insufficient restrictions on which posts can be included. network low complexity CWE-639	4.3
2024-12-14	CVE-2024-12447	The Get Post Content Shortcode plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 0.4 via the 'post-content' shortcode due to missing validation on a user controlled key. network low complexity CWE-639	4.3
2024-12-13	CVE-2024-11275	The WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the /wp-json/timetics/v1/customers/ REST API endpoint in all versions up to, and including, 1.0.27. network low complexity CWE-639	4.3
2024-12-13	CVE-2024-12309	The Rate My Post – Star Rating Plugin by FeedbackWP plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.4 via the get_post_status() due to missing validation on a user controlled key. network low complexity CWE-639	5.3