CVE Vulnerability Catalog

The WordPress plugin Leadrebel up to version 1.0.2 suffers from a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

Missing Authorization vulnerability in TrueBooker up to version 1.1.5 allows exploiting incorrectly configured access control security levels.

Missing authorization in the Product Price by Formula for WooCommerce plugin (product-price-by-formula-for-woocommerce) allows exploiting incorrectly configured access control security levels. The vulnerability affects versions up to 2.5.6 inclusive.

The Panda Pods Repeater Field WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 1.5.12.

The leadlovers-forms WordPress plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 1.0.2.

Missing Authorization vulnerability in Razorpay for WooCommerce up to version 4.8.2 allows exploiting incorrectly configured access control security levels.

The WP Simple HTML Sitemap plugin for WordPress is vulnerable to DOM-based XSS. Lack of proper input sanitization allows script injection.

The Video Conferencing with Zoom WordPress plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 4.6.6.

The iGMS Direct Booking WordPress plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 1.3.

The Total Poll Lite plugin for WordPress up to version 4.12.0 has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels.

Missing Authorization vulnerability in UnitechPay up to version 1.0.2 allows exploiting incorrectly configured access control security levels.

The Royale News plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 2.2.4.

The Cream Blog WordPress theme has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 2.1.7.

The MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF). An attacker can force the server to send requests to internal resources.

The Leaflet Map plugin for WordPress up to version 3.4.4 contains a stored XSS vulnerability. Improper input neutralization during page generation allows an attacker to inject malicious scripts.

The GlobalPayments WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF). An attacker can send requests from the server to internal or external resources.

The Wp Ultimate Review WordPress plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 2.3.8.

The Payment Plugins for PayPal WooCommerce plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 2.0.13.

The Blackfyre plugin for WordPress is vulnerable to CSRF attacks. An attacker can trick an administrator into performing unintended actions.

The RPS Include Content plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects all versions from n/a through 1.2.2.