The WP Customer Area WordPress plugin before 8.2.1 does not properly validates user capabilities in some of its AJAX actions, allowing any users to retrieve other user's account address.

CVE-2023-6875CRITICALCVSS 9.8EG 9.8

2024-01-11

The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a type juggling issue on the connect-app …

CVE-2023-6897MEDIUMCVSS 4.3EG 4.3

2024-04-18

The EAN for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.9.2 via the the 'alg_wc_ean_product_meta' shortcode due to missing validation on a user controlled key. …

CVE-2023-6929HIGHCVSS 7.5EG 7.5

2023-12-19

EuroTel ETL3100 versions v01c01 and v01x37 are vulnerable to insecure direct object references that occur when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability, attacker…

CVE-2023-6969MEDIUMCVSS 4.3EG 5.3

2024-03-13

The User Shortcodes Plus plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.2 via the user_meta shortcode due to missing validation on a user controlled key. This makes it possi…

CVE-2023-6983MEDIUMCVSS 4.3EG 4.3

2024-02-05

The Display custom fields in the frontend – Post and User Profile Fields plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.1 via the vg_display_data shortcode due to missing …

CVE-2023-7031MEDIUMCVSS 5.7EG 5.7

2024-01-17

Insecure Direct Object Reference vulnerabilities were discovered in the Avaya Aura Experience Portal Manager which may allow partial information disclosure to an authenticated non-privileged user. Affected versions include 8.0.x and 8.1.x,…

CVE-2023-7049MEDIUMCVSS 4.3EG 4.3

2024-08-16

The Custom Field For WP Job Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2 via the the 'cm_fieldshow' shortcode due to missing validation on the 'job_id' user contro…

CVE-2023-7198MEDIUMCVSS 4.3EG 4.3

2024-02-27

The WP Dashboard Notes WordPress plugin before 1.0.11 is vulnerable to Insecure Direct Object References (IDOR) in post_id= parameter. Authenticated users are able to delete private notes associated with different user accounts. This poses…

CVE-2023-7199MEDIUMCVSS 5.3EG 5.3

2024-01-29

The Relevanssi WordPress plugin before 4.22.0, Relevanssi Premium WordPress plugin before 2.25.0 allows any unauthenticated user to read draft and private posts via a crafted request

CVE-2023-7286MEDIUMCVSS 6.5EG 6.5

2024-10-16

The plugin ACF Quick Edit Fields for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.2.2. This makes it possible for attackers without the edit_users capability to access metadata of other us…

CVE-2024-0264HIGHCVSS 7.3EG 7.3

2024-01-07

A vulnerability was found in SourceCodester Clinic Queuing System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /LoginRegistration.php. The manipulation of the argument formToken leads to author…

CVE-2024-0366MEDIUMCVSS 4.3EG 4.3

2024-02-05

The Starbox – the Author Box for Humans plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.4.7 via the action function due to missing validation on a user controlled key. This m…

CVE-2024-0421MEDIUMCVSS 5.3EG 5.3

2024-02-12

The MapPress Maps for WordPress plugin before 2.88.16 is affected by an IDOR as it does not ensure that posts to be retrieve via an AJAX action is a public map, allowing unauthenticated users to read arbitrary private and draft posts.

CVE-2024-0580MEDIUMCVSS 6.5EG 6.5

2024-01-18

Omission of user-controlled key authorization in the IDMSistemas platform, affecting the QSige product. This vulnerability allows an attacker to extract sensitive information from the API by making a request to the parameter '/qsige.locato…

CVE-2024-0839MEDIUMCVSS 5.3EG 5.3

2024-03-13

The FeedWordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2022.0222 due to missing validation on the user controlled 'guid' key. This makes it possible for unauthenticate…

CVE-2024-0872MEDIUMCVSS 4.3EG 4.3

2024-04-09

The Watu Quiz plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.1 via the watu-userinfo shortcode. This makes it possible for authenticated attackers, with contributor-level acce…

CVE-2024-10121HIGHCVSS 7.3EG 7.3

2024-10-18

A vulnerability was found in wfh45678 Radar up to 1.0.8 and classified as critical. This issue affects some unknown processing of the component Interface Handler. The manipulation with the input /../ leads to authorization bypass. The atta…

CVE-2024-10174HIGHCVSS 7.3EG 7.3

2024-11-13

The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.6.13 via the 'Abstr…

CVE-2024-10215CRITICALCVSS 9.8EG 9.8

2025-01-09

The WPBookit plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.6.4. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and acces…

CVE-2024-10366MEDIUMCVSS 6.5EG 7.6

2025-03-20

An improper access control vulnerability (IDOR) exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. The endpoint does not verify whether the provided attachment ID belongs to the current user, allowi…

CVE-2024-10439MEDIUMCVSS 5.3EG 5.3

2024-10-28

The eHRD CTMS from Sunnet has an Insecure Direct Object Reference (IDOR) vulnerability, allowing unauthenticated remote attackers to modify a specific parameter to access arbitrary files uploaded by any user.

CVE-2024-10452LOWCVSS 2.2EG 2.2

2024-10-29

Organization admins can delete pending invites created in an organization they are not part of.

CVE-2024-10497HIGHCVSS 8.8EG 8.8

2025-01-17

CWE-639: Authorization Bypass Through User-Controlled Key vulnerability exists that could allow an authorized attacker to modify values outside those defined by their privileges (Elevation of Privileges) when the attacker sends modified HT…

CVE-2024-10654MEDIUMCVSS 5.3EG 5.3

2024-11-01

A vulnerability has been found in TOTOLINK LR350 up to 9.3.5u.6369 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /formLoginAuth.htm. The manipulation of the argument authCode with the in…

CVE-2024-10666MEDIUMCVSS 4.3EG 4.3

2024-11-22

The Easy Twitter Feed – Twitter feeds plugin for WP plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.6 via the [etf] shortcode. This makes it possible for authenticated attackers, with …

CVE-2024-10667MEDIUMCVSS 4.3EG 4.3

2024-11-09

The Content Slider Block plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.1.5 via the [csb] shortcode due to insufficient restrictions on which posts can be included. This makes it possible…

CVE-2024-10669MEDIUMCVSS 4.3EG 4.3

2024-11-09

The Countdown Timer block – Display the event's date into a timer. plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.4 via the [ctb] shortcode due to insufficient restrictions on wh…

CVE-2024-10670MEDIUMCVSS 4.3EG 4.3

2024-11-28

The Primary Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.6.2 via the [prim_elementor_template] shortcode due to insufficient restrictions on which posts can be inclu…

CVE-2024-10671MEDIUMCVSS 4.3EG 4.3

2024-11-21

The Button Block – Get fully customizable & multi-functional buttons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.4 via the [btn_block] shortcode due to insufficient restrictions on…

CVE-2024-10688MEDIUMCVSS 4.3EG 4.3

2024-11-09

The Attesa Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.2 via the 'attesa-template' shortcode due to insufficient restrictions on which posts can be included. This makes it poss…

CVE-2024-10689MEDIUMCVSS 4.3EG 4.3

2024-12-06

The XLTab – Accordions and Tabs for Elementor Page Builder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4 via the 'XLTAB_INSERT_TPL' shortcode due to insufficient restrictions on whic…

CVE-2024-10690MEDIUMCVSS 4.3EG 4.3

2024-12-14

The Shortcodes for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.4 via the 'SHORTCODE_ELEMENTOR' shortcode due to insufficient restrictions on which posts can be included. Th…

CVE-2024-10692MEDIUMCVSS 4.3EG 4.3

2024-12-06

The PowerPack Elementor Addons (Free Widgets, Extensions and Templates) plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.8.1 via the Content Reveal widget due to insufficient restrictions o…

CVE-2024-10693MEDIUMCVSS 4.3EG 4.3

2024-11-09

The SKT Addons for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.3 via the Unfold widget due to insufficient restrictions on which posts can be included. This makes it possible…

CVE-2024-10695MEDIUMCVSS 4.3EG 4.3

2024-11-12

The Futurio Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.0.13 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it…

CVE-2024-10696MEDIUMCVSS 4.3EG 4.3

2024-11-21

The UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and …

CVE-2024-1075LOWCVSS 3.7EG 3.7

2024-02-05

The Minimal Coming Soon – Coming Soon Page plugin for WordPress is vulnerable to maintenance mode bypass and information disclosure in all versions up to, and including, 2.37. This is due to the plugin improperly validating the request p…

CVE-2024-10770MEDIUMCVSS 4.3EG 4.3

2024-11-09

The Envo Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.3 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes it pos…

CVE-2024-10775MEDIUMCVSS 4.3EG 4.3

2025-01-15

The Piotnet Addons For Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.4.32 via the 'pafe-template' shortcode due to insufficient restrictions on which posts can be included. Thi…

CVE-2024-10777MEDIUMCVSS 4.3EG 4.3

2024-12-05

The AnyWhere Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.11 via the 'INSERT_ELEMENTOR' shortcode due to insufficient restrictions on which posts can be included. This makes…

CVE-2024-10778MEDIUMCVSS 4.3EG 4.3

2024-11-13

The BuddyPress Builder for Elementor – BuddyBuilder plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.4 via the 'elementor-template' shortcode due to insufficient restrictions on which p…

CVE-2024-10779MEDIUMCVSS 5.3EG 5.3

2024-11-09

The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.0 via the 'ce_template' shortcode due to insufficient restrictions on which posts can be included. This…

CVE-2024-10780MEDIUMCVSS 4.3EG 4.3

2024-11-28

The Restaurant & Cafe Addon for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.5.9 via the 'narestaurant_elementor_template' shortcode due to insufficient restrictions on which …

CVE-2024-10782MEDIUMCVSS 4.3EG 4.3

2024-11-21

The Theme Builder For Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.2 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. …

CVE-2024-10787MEDIUMCVSS 4.3EG 4.3

2024-12-04

The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.4 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be in…

CVE-2024-10794MEDIUMCVSS 4.3EG 4.3

2024-11-13

The Boostify Header Footer Builder for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.3.6 via the 'bhf' shortcode due to insufficient restrictions on which posts can be included…

CVE-2024-10795MEDIUMCVSS 4.3EG 4.3

2024-11-16

The Popularis Extra plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.7 via the 'elementor-template' shortcode due to insufficient restrictions on which posts can be included. This makes i…

CVE-2024-10796MEDIUMCVSS 4.3EG 4.3

2024-11-21

The If-So Dynamic Content Personalization plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.9.2.1 via the 'ifso-show-post' shortcode due to insufficient restrictions on which posts can be in…

CVE-2024-10797MEDIUMCVSS 4.3EG 4.3

2024-12-21

The Full Screen Menu for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.7 via the Full Screen Menu Elementor Widget due to insufficient restrictions on which posts can be inc…

CWE-639— Authorization Bypass Through User-Controlled Key (IDOR)

CVEs classified under CWE-639page 12 of 32

Map vulnerabilities like CWE-639 to your infrastructure