newsThe portal itself — self-promo until real sponsors land
Subscribe, build a custom feed, or pitch a sponsorship at hello@acadenix.com
Latest intel// live feed
25 results//sorted by published//last sync 2026-07-15 02:07Z
Subscribe to news →
CVE-2021-4381 — Stylemixthemes Ulisting: The uListing plugin for WordPress is vulnerable to authorization bypass via wp_route due to
The uListing plugin for WordPress is vulnerable to authorization bypass via wp_route due to missing capability checks, and a missing security nonce, in the StmListingSingleLayout::import_new_layout method in versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to change any WordPress option in the database. CVSSv3.1 9.8 (CRITICAL) · EPSS 62th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2021-4374 — Valvepress Wordpress_automatic_plugin: The WordPress Automatic Plugin for WordPress is vulnerable to arbitrary options updates in versions
The WordPress Automatic Plugin for WordPress is vulnerable to arbitrary options updates in versions up to, and including, 3.53.2. This is due to missing authorization and option validation in the process_form.php file. This makes it possible for unauthenticated attackers to arbitrarily update the settings of a vulnerable site and ultimately compromise the entire site. CVSSv3.1 9.1 (CRITICAL) · EPSS 99th percentile
9.1
CVSS v3.1
100
Edit Score
CVE-2021-4373 — Webberzone Better_search: The Better Search plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions
The Better Search plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.2. This makes it possible for unauthenticated attackers to import settings via forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVSSv3.1 8.8 (HIGH) · EPSS 33th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2021-4370 — Stylemixthemes Ulisting: The uListing plugin for WordPress is vulnerable to authorization bypass as most actions and
The uListing plugin for WordPress is vulnerable to authorization bypass as most actions and endpoints are accessible to unauthenticated users, lack security nonces, and data is seldom validated. This issue exists in versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to conduct numerous administrative actions, including those less critical than the explicitly outlined ones in our detection. CVSSv3.1 9.8 (CRITICAL) · EPSS 62th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2021-4368 — Najeebmedia Frontend_file_manager_plugin: The Frontend File Manager plugin for WordPress is vulnerable to Authenticated Settings Change in
The Frontend File Manager plugin for WordPress is vulnerable to Authenticated Settings Change in versions up to, and including, 18.2. This is due to lacking capability checks and a security nonce, all on the wpfm_save_settings AJAX action. This makes it possible for subscriber-level attackers to edit the plugin settings, such as the allowed upload file types. This can lead to remote code execution through other vulnerabilities. CVSSv3.1 9.9 (CRITICAL) · EPSS 92th percentile
9.9
CVSS v3.1
100
Edit Score
CVE-2021-4361 — Eyecix Jobsearch_wp_job_board: The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due
The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearch_job_integrations_settin_save AJAX action in versions up to, and including, 1.8.1. This makes it possible for authenticated attackers to update arbitrary options on the site. CVSSv3.1 8.8 (HIGH) · EPSS 50th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2021-4360 — Wpruby Controlled_admin_access: The Controlled Admin Access plugin for WordPress is vulnerable to Privilege Escalation in versions
The Controlled Admin Access plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.5 by not properly restricting access to the configuration page. This makes it possible for attackers to create a new administrator role with unrestricted access. CVSSv3.1 9.9 (CRITICAL) · EPSS 32th percentile
9.9
CVSS v3.1
100
Edit Score
CVE-2021-4357 — Stylemixthemes Ulisting: The uListing plugin for WordPress is vulnerable to authorization bypass due to missing capability
The uListing plugin for WordPress is vulnerable to authorization bypass due to missing capability checks, and a missing security nonce, on the UlistingUserRole::save_role_api function in versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to arbitrarily delete site posts and pages. CVSSv3.1 9.1 (CRITICAL) · EPSS 29th percentile
9.1
CVSS v3.1
96
Edit Score
CVE-2021-4356 — Najeebmedia Frontend_file_manager_plugin: The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Download
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Download in versions up to, and including, 18.2. This is due to lacking authentication protections, capability checks, and sanitization, all on the wpfm_file_meta_update AJAX action. This makes it possible for unauthenticated attackers to download arbitrary files on the site, potentially leading to site takeover. CVSSv3.1 9.0 (CRITICAL) · EPSS 73th percentile
9.0
CVSS v3.1
95
Edit Score
CVE-2021-4354 — Magazine3 Pwa_for_wp_\&_amp: The PWA for WP & AMP for WordPress is vulnerable to arbitrary file uploads
The PWA for WP & AMP for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the pwaforwp_splashscreen_uploader function in versions up to, and including, 1.7.32. This makes it possible for authenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible. CVSSv3.1 8.8 (HIGH) · EPSS 92th percentile
8.8
CVSS v3.1
96
Edit Score
CVE-2021-4349 — Coolplugins Process_steps_template_designer: The Process Steps Template Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery
The Process Steps Template Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This makes it possible for unauthenticated attackers to conduct unspecified attacks via forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVSSv3.1 8.8 (HIGH) · EPSS 59th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2021-4347 — Zorem Advanced_shipment_tracking_for_woocommerce: The function update_shipment_status_email_status_fun in the plugin Advanced Shipment Tracking for WooCommerce in versions up
The function update_shipment_status_email_status_fun in the plugin Advanced Shipment Tracking for WooCommerce in versions up to 3.2.6 is vulnerable to authenticated arbitrary options update. The function allows attackers (including those at customer level) to update any WordPress option in the database. Version 3.2.5 was initially released as a fix, but doesn't fully address the issue. CVSSv3.1 9.9 (CRITICAL) · EPSS 31th percentile
9.9
CVSS v3.1
100
Edit Score
CVE-2021-4346 — Stylemixthemes Ulisting: The uListing plugin for WordPress is vulnerable to Unauthenticated Arbitrary Account Changes in versions
The uListing plugin for WordPress is vulnerable to Unauthenticated Arbitrary Account Changes in versions up to, and including, 1.6.6. This is due to missing login checks on the stm_listing_profile_edit AJAX action. This makes it possible for unauthenticated attackers to edit any account on the blog, such as changing the admin account's email address. CVSSv3.1 9.8 (CRITICAL) · EPSS 66th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2021-4343 — Stylemixthemes Ulisting: The Unauthenticated Account Creation plugin for WordPress is vulnerable to Unauthenticated Account Creation in
The Unauthenticated Account Creation plugin for WordPress is vulnerable to Unauthenticated Account Creation in versions up to, and including, 1.6.6. This is due to the stm_listing_register AJAX action function being accessible and taking roles unprotected. This makes it possible for unauthenticated attackers to create accounts, even those with administrator privileges. CVSSv3.1 9.8 (CRITICAL) · EPSS 73th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2021-4341 — Stylemixthemes Ulisting: The uListing plugin for WordPress is vulnerable to authorization bypass via Ajax due to
The uListing plugin for WordPress is vulnerable to authorization bypass via Ajax due to missing capability checks, missing input validation, and a missing security nonce in the stm_update_email_data AJAX action in versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to change any WordPress option in the database. CVSSv3.1 9.8 (CRITICAL) · EPSS 47th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2021-4340 — Stylemixthemes Ulisting: The uListing plugin for WordPress is vulnerable to generic SQL Injection via the ‘listing_id’
The uListing plugin for WordPress is vulnerable to generic SQL Injection via the ‘listing_id’ parameter in versions up to, and including, 1.6.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVSSv3.1 9.8 (CRITICAL) · EPSS 75th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2020-36731 — Wpdesk Flexible_checkout_fields: The Flexible Checkout Fields for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary
The Flexible Checkout Fields for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary Plugin Settings update, in addition to Stored Cross-Site Scripting in versions up to, and including, 2.3.1. This is due to missing authorization checks on the updateSettingsAction() function which is called via an admin_init hook, along with missing sanitization and escaping on the settings that are stored. CVSSv3.1 7.2 (HIGH) · EPSS 95th percentile
7.2
CVSS v3.1
92
Edit Score
CVE-2020-36730 — Niteothemes Cmp: The CMP for WordPress is vulnerable to authorization bypass due to a missing capability
The CMP for WordPress is vulnerable to authorization bypass due to a missing capability check on the cmp_get_post_detail(), niteo_export_csv(), and cmp_disable_comingsoon_ajax() functions in versions up to, and including, 3.8.1. This makes it possible for unauthenticated attackers to read posts, export subscriber lists, and/or deactivate the plugin. CVSSv3.1 8.3 (HIGH) · EPSS 98th percentile
8.3
CVSS v3.1
100
Edit Score
CVE-2020-36727 — Xyzscripts Newsletter_manager: The Newsletter Manager plugin for WordPress is vulnerable to insecure deserialization in versions up
The Newsletter Manager plugin for WordPress is vulnerable to insecure deserialization in versions up to, and including, 1.5.1. This is due to unsanitized input from the 'customFieldsDetails' parameter being passed through a deserialization function. This potentially makes it possible for unauthenticated attackers to inject a serialized PHP object. CVSSv3.1 9.8 (CRITICAL) · EPSS 79th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2020-36726 — Etoilewebdesign Ultimate_reviews: The Ultimate Reviews plugin for WordPress is vulnerable to PHP Object Injection in versions
The Ultimate Reviews plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.1.32 via deserialization of untrusted input in several vulnerable functions. This allows unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. CVSSv3.1 9.8 (CRITICAL) · EPSS 79th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2020-36725 — Templateinvaders Ti_woocommerce_wishlist: The TI WooCommerce Wishlist and TI WooCommerce Wishlist Pro plugins for WordPress are vulnerable
The TI WooCommerce Wishlist and TI WooCommerce Wishlist Pro plugins for WordPress are vulnerable to an Options Change vulnerability in versions up to, and including, 1.21.11 and 1.21.4 via the 'ti-woocommerce-wishlist/includes/export.class.php' file. This makes it possible for authenticated attackers to gain otherwise restricted access to the vulnerable blog and update any settings. CVSSv3.1 8.8 (HIGH) · EPSS 69th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2020-36724 — Wordable Wordable: The Wordable plugin for WordPress is vulnerable to authentication bypass in versions up to
The Wordable plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.1.1. This is due to the use of a user supplied hashing algorithm passed to the hash_hmac() function and the use of a loose comparison on the hash which allows an attacker to trick the function into thinking it has a valid hash. This makes it possible for unauthenticated attackers to gain administrator privileges. CVSSv3.1 9.8 (CRITICAL) · EPSS 40th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2020-36723 — Cridio Listingpro: The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Sensitive
The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Sensitive Data Exposure in versions before 2.6.1 via the ~/listingpro-plugin/functions.php file. This makes it possible for unauthenticated attackers to extract sensitive data including usernames, full names, email addresses, phone numbers, physical addresses and user post counts. CVSSv3.1 5.3 (MEDIUM) · EPSS 96th percentile
5.3
CVSS v3.1
83
Edit Score
CVE-2020-36719 — Cridio Listingpro: The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Arbitrary
The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Arbitrary Plugin Installation, Activation and Deactivation in versions before 2.6.1. This is due to a missing capability check on the lp_cc_addons_actions function. This makes it possible for unauthenticated attackers to arbitrarily install, activate and deactivate any plugin. CVSSv3.1 9.8 (CRITICAL) · EPSS 99th percentile
9.8
CVSS v3.1
100
Edit Score
CVE-2020-36718 — Ninjateam Gpdr_ccpa_compliance_support: The GDPR CCPA Compliance Support plugin for WordPress is vulnerable to PHP Object Injection
The GDPR CCPA Compliance Support plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.3 via deserialization of untrusted input "njt_gdpr_allow_permissions" value. This allows unauthenticated attackers to inject a PHP Object. CVSSv3.1 9.8 (CRITICAL) · EPSS 83th percentile
9.8
CVSS v3.1
100
Edit Score