Total
4592 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-47358 | 1 Code-atlantic | 1 Popup Maker | 2024-11-12 | N/A | 9.8 CRITICAL |
| Missing Authorization vulnerability in Popup Maker allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Popup Maker: from n/a through 1.19.2. | |||||
| CVE-2024-47359 | 1 Depicter | 1 Depicter | 2024-11-12 | N/A | 9.8 CRITICAL |
| Missing Authorization vulnerability in Depicter Slider and Popup by Averta Depicter Slider allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Depicter Slider: from n/a through 3.2.2. | |||||
| CVE-2024-47361 | 1 Webtechstreet | 1 Elementor Addon Elements | 2024-11-12 | N/A | 8.8 HIGH |
| Missing Authorization vulnerability in WPVibes Elementor Addon Elements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elementor Addon Elements: from n/a through 1.13.6. | |||||
| CVE-2024-10586 | 2024-11-12 | N/A | 9.8 CRITICAL | ||
| The Debug Tool plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check on the dbt_pull_image() function and missing file type validation in all versions up to, and including, 2.2. This makes it possible for unauthenticated attackers to to create arbitrary files such as .php files that can be leveraged for remote code execution. | |||||
| CVE-2024-10589 | 2024-11-12 | N/A | 9.8 CRITICAL | ||
| The Leopard - WordPress Offload Media plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the import_settings() function in all versions up to, and including, 3.1.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. | |||||
| CVE-2024-10674 | 2024-11-12 | N/A | 8.8 HIGH | ||
| The Th Shop Mania theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the th_shop_mania_install_and_activate_callback() function in all versions up to, and including, 1.4.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install arbitrary plugins which can be leveraged to exploit other vulnerabilities and achieve remote code execution and privilege escalation. | |||||
| CVE-2024-10673 | 2024-11-12 | N/A | 8.8 HIGH | ||
| The Top Store theme for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the top_store_install_and_activate_callback() function in all versions up to, and including, 1.5.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins which can contain other exploitable vulnerabilities to elevate privileges and gain remote code execution. | |||||
| CVE-2024-10588 | 2024-11-12 | N/A | 4.3 MEDIUM | ||
| The Debug Tool plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the info() function in all versions up to, and including, 2.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to obtain information from phpinfo(). When WP_DEBUG is enabled, this can be exploited by unauthenticated users as well. | |||||
| CVE-2024-42372 | 2024-11-12 | N/A | 6.5 MEDIUM | ||
| Due to missing authorization check in SAP NetWeaver AS Java (System Landscape Directory) an unauthorized user can read and modify some restricted global SLD configurations causing low impact on confidentiality and integrity of the application. | |||||
| CVE-2024-47587 | 2024-11-12 | N/A | 3.5 LOW | ||
| Cash Operations does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges causing low impact to confidentiality to the application. | |||||
| CVE-2024-44021 | 1 Truepush | 1 Truepush | 2024-11-08 | N/A | 8.8 HIGH |
| Missing Authorization vulnerability in Truepush allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Truepush: from n/a through 1.0.8. | |||||
| CVE-2024-44031 | 1 Beardev | 1 Joomsport | 2024-11-08 | N/A | 8.8 HIGH |
| Missing Authorization vulnerability in BearDev JoomSport allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JoomSport: from n/a through 5.6.3. | |||||
| CVE-2024-44038 | 1 Sunshinephotocart | 1 Sunshine Photo Cart | 2024-11-08 | N/A | 9.8 CRITICAL |
| Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 3.2.9. | |||||
| CVE-2024-44052 | 1 Helloasso | 1 Helloasso | 2024-11-08 | N/A | 8.8 HIGH |
| Missing Authorization vulnerability in HelloAsso allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HelloAsso: from n/a through 1.1.10. | |||||
| CVE-2024-10535 | 1 Martinvalchev | 1 Video Gallery For Woocommerce | 2024-11-08 | N/A | 5.3 MEDIUM |
| The Video Gallery for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the remove_unused_thumbnails() function in all versions up to, and including, 1.31. This makes it possible for unauthenticated attackers to delete thumbnails in the video-wc-gallery-thumb directory. | |||||
| CVE-2024-10543 | 1 Tumult | 1 Tumult Hype Animations | 2024-11-08 | N/A | 4.3 MEDIUM |
| The Tumult Hype Animations plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hypeanimations_getcontent function in all versions up to, and including, 1.9.14. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve animation information. | |||||
| CVE-2024-6626 | 1 Theinnovs | 1 Eleforms | 2024-11-08 | N/A | 5.3 MEDIUM |
| The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on several functions in all versions up to, and including, 2.9.9.9. This makes it possible for unauthenticated attackers to view form submissions. | |||||
| CVE-2024-43998 | 1 Websiteinwp | 1 Blogpoet | 2024-11-08 | N/A | 9.8 CRITICAL |
| Missing Authorization vulnerability in WebsiteinWP Blogpoet allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blogpoet: from n/a through 1.0.3. | |||||
| CVE-2024-43982 | 1 Geekcodelab | 1 Login As Users | 2024-11-08 | N/A | 8.8 HIGH |
| Missing Authorization vulnerability in Geek Code Lab Login As Users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login As Users: from n/a through 1.4.3. | |||||
| CVE-2024-43981 | 1 Ayecode | 1 Geodirectory | 2024-11-08 | N/A | 8.8 HIGH |
| Missing Authorization vulnerability in AyeCode – WP Business Directory Plugins GeoDirectory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GeoDirectory: from n/a through 2.3.70. | |||||