Vulnerabilities > Missing Authorization

DATE CVE VULNERABILITY TITLE RISK
2025-01-16 CVE-2024-12427 The Multi Step Form plugin for WordPress is vulnerable to unauthorized limited file upload due to a missing capability check on the fw_upload_file AJAX action in all versions up to, and including, 1.7.23.
network
low complexity
CWE-862
5.3
5.3
2025-01-15 CVE-2024-11848 The NitroPack plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nitropack_dismiss_notice_forever' AJAX action in all versions up to, and including, 1.17.0.
network
low complexity
CWE-862
8.1
8.1
2025-01-15 CVE-2024-11851 The NitroPack plugin for WordPress is vulnerable to unauthorized arbitrary transient update due to a missing capability check on the nitropack_rml_notification function in all versions up to, and including, 1.17.0.
network
low complexity
CWE-862
4.3
4.3
2025-01-14 CVE-2024-12006 Missing Authorization vulnerability in Boldgrid W3 Total Cache
The W3 Total Cache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 2.8.1.
network
low complexity
boldgrid CWE-862
5.3
5.3
2025-01-14 CVE-2024-12365 Missing Authorization vulnerability in Boldgrid W3 Total Cache
The W3 Total Cache plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the is_w3tc_admin_page function in all versions up to, and including, 2.8.1.
network
low complexity
boldgrid CWE-862
8.5
8.5
2025-01-11 CVE-2024-12204 The Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions in the class-cx-rest.php file in all versions up to, and including, 1.3.5.
network
low complexity
CWE-862
5.4
5.4
2025-01-10 CVE-2024-12606 The AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the engine_request_data() function in all versions up to, and including, 2.3.
network
low complexity
CWE-862
4.3
4.3
2025-01-09 CVE-2024-11929 The Responsive FlipBook Plugin Wordpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the rfbwp_save_settings() functionin all versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping.
network
low complexity
CWE-862
6.4
6.4
2025-01-09 CVE-2024-12249 The GS Insever Portfolio plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_settings() function in all versions up to, and including, 1.4.5.
network
low complexity
CWE-862
4.3
4.3
2025-01-09 CVE-2024-12542 The linkID plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when including the 'phpinfo' function in all versions up to, and including, 0.1.2.
network
low complexity
CWE-862
8.6
8.6