Vulnerabilities > Missing Authorization

DATE CVE VULNERABILITY TITLE RISK
2025-01-11 CVE-2024-12204 The Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several functions in the class-cx-rest.php file in all versions up to, and including, 1.3.5.
network
low complexity
CWE-862
5.4
5.4
2025-01-10 CVE-2024-12606 The AI Scribe – SEO AI Writer, Content Generator, Humanizer, Blog Writer, SEO Optimizer, DALLE-3, AI WordPress Plugin ChatGPT (GPT-4o 128K) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the engine_request_data() function in all versions up to, and including, 2.3.
network
low complexity
CWE-862
4.3
4.3
2025-01-09 CVE-2024-11929 The Responsive FlipBook Plugin Wordpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the rfbwp_save_settings() functionin all versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping.
network
low complexity
CWE-862
6.4
6.4
2025-01-09 CVE-2024-12249 The GS Insever Portfolio plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_settings() function in all versions up to, and including, 1.4.5.
network
low complexity
CWE-862
4.3
4.3
2025-01-09 CVE-2024-12542 The linkID plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when including the 'phpinfo' function in all versions up to, and including, 0.1.2.
network
low complexity
CWE-862
8.6
8.6
2025-01-09 CVE-2024-12616 The Bitly's WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions in all versions up to, and including, 2.7.3.
network
low complexity
CWE-862
4.3
4.3
2025-01-09 CVE-2024-12618 The Newsletter2Go plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'resetStyles' AJAX action in all versions up to, and including, 4.0.14.
network
low complexity
CWE-862
4.3
4.3
2025-01-09 CVE-2024-12848 The SKT Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the 'addLibraryByArchive' function in all versions up to, and including, 4.6.
network
low complexity
CWE-862
8.8
8.8
2025-01-09 CVE-2024-5769 The MIMO Woocommerce Order Tracking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 1.0.2.
network
low complexity
CWE-862
4.3
4.3
2025-01-09 CVE-2024-6155 The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Authenticated (Subscriber+) Server-Side Request Forgery and Stored Cross Site Scripting in all versions up to, and including, 9.0.0 due to a missing capability check in the greenshift_download_file_localy function, along with no SSRF protection and sanitization on uploaded SVG files.
network
low complexity
CWE-862
6.4
6.4