CVE Vulnerability Catalog

Broken Function Level Authorization allows execution of poller post-restart commands by an authenticated user. The lack of function-level permission checks enables access to restricted operations.

Missing Authorization vulnerability in the myCred (mycred) plugin allows exploitation of incorrectly configured access control security levels. This issue affects myCred from n/a through 4.0.2.

The MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to trigger the stm_lms_send_test_email_ajax AJAX action without capability or nonce validation. Attackers can invoke this handler directly or via cross-site request forgery to cause an uncaught PHP fatal error that, when display_errors is enabled, discloses the plugin's absolute filesystem path.

The MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated Subscriber-level users to import arbitrary WXR XML files by supplying directory traversal sequences in the stm_lms_step parameter passed to the stm_lms_import_sample_data AJAX action, which lacks capability checks and nonce verification. Attackers can traverse the file system to reference a reachable WXR file and have the handler publish its contained posts under their identity, enabling publication of attacker-chosen post type, title, content, and metadata.

Missing Authorization vulnerability in the ShopBuilder – Elementor WooCommerce Builder Addons (shopbuilder) plugin allows exploitation of incorrectly configured access control security levels. This issue affects ShopBuilder from n/a through 3.4.2.

Missing Authorization vulnerability in Cozmoslabs Profile Builder (profile-builder) allows exploitation of incorrectly configured access control security levels. This issue affects Profile Builder from n/a through 4.0.5.

Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) (page-and-post-restriction) allows exploitation of incorrectly configured access control security levels. This issue affects Page Restriction WordPress (WP) from n/a through 1.6.1.

The WP User Frontend plugin (weDevs) up to version 4.3.13 contains a Missing Authorization vulnerability due to insufficient access control checks. This allows exploitation of incorrectly configured access control security levels.

The WP User Frontend plugin (weDevs) up to version 4.3.13 contains a Missing Authorization vulnerability due to insufficient access control checks. It allows exploitation of incorrectly configured access control security levels.

The EventPrime plugin up to version 4.3.6.0 contains an Authorization Bypass Through User-Controlled Key vulnerability that allows bypassing authorization checks. This can lead to privilege abuse.

The Gutenberg Blocks by Kadence Blocks plugin (Liquid Web / StellarWP) up to version 3.8.0.2 contains a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation. This allows stored script injection.

The JetElements For Elementor plugin (Crocoblock) up to version 2.9.2.6 contains a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation. This allows stored script injection.

The Kit plugin (formerly ConvertKit) up to version 3.4.7 contains a Missing Authorization vulnerability due to insufficient access control checks. It allows exploitation of incorrectly configured access control security levels.

The WPFunnels plugin up to version 3.13.5 contains a Cross-Site Request Forgery (CSRF) vulnerability. It allows an attacker to force a logged-in user to perform unwanted actions.

The User Registration plugin (ThemeGrill) up to version 5.3.0 contains a Missing Authorization vulnerability due to insufficient access control checks. It allows exploitation of incorrectly configured access control security levels.

The WP ERP plugin (weDevs) up to version 1.17.10 contains a Missing Authorization vulnerability due to insufficient access control checks. It allows exploitation of incorrectly configured access control security levels.

The Flash & HTML5 Video plugin (bPlugins) up to version 2.14.0 contains a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation. This allows stored script injection.

The Media Library Assistant WordPress plugin (up to version 3.42) is vulnerable to DOM-Based Cross-site Scripting (XSS) due to improper neutralization of input during web page generation. The flaw allows injection of malicious script that executes in the user's browser.

The MasterStudy LMS WordPress plugin (up to version 3.7.55) has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user may perform actions reserved for privileged roles.

The WPFunnels WordPress plugin (up to version 3.13.5) contains a missing authorization vulnerability enabling exploitation of incorrectly configured access control security levels. An unauthorized user may gain access to functions or data they should not have rights to.