CWE-862 · Missing Authorization (page 29)
Page 29 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-66068 | Medium | 6.5 | 2025-12-18 | Missing Authorization vulnerability in InstaWP InstaWP Connect instawp-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2025-66054 | High | 7.5 | 2025-12-18 | Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2025-64378 | High | 7.1 | 2025-12-18 | Missing Authorization vulnerability in CridioStudio ListingPro listingpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2025-64375 | Medium | 6.5 | 2025-12-18 | Missing Authorization vulnerability in Mahmudul Hasan Arif WP Social Ninja wp-social-reviews allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-64273 | Medium | 6.5 | 2025-12-18 | Missing Authorization vulnerability in GetResponse Email marketing for WordPress by GetResponse Official getresponse-official allows Exploiting Incorrectly Con… |
CVE-2025-64268 | High | 7.5 | 2025-12-18 | Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects T… |
CVE-2025-64222 | High | 7.5 | 2025-12-18 | Missing Authorization vulnerability in FantasticPlugins WooCommerce Recover Abandoned Cart rac allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-64214 | High | 7.5 | 2025-12-18 | Missing Authorization vulnerability in StylemixThemes MasterStudy LMS Pro masterstudy-lms-learning-management-system-pro allows Accessing Functionality Not Pro… |
CVE-2025-64209 | High | 7.5 | 2025-12-18 | Missing Authorization vulnerability in StylemixThemes Masterstudy masterstudy allows Accessing Functionality Not Properly Constrained by ACLs.This issue affect… |
CVE-2025-64192 | Medium | 6.3 | 2025-12-18 | Missing Authorization vulnerability in 8theme XStore xstore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects XStore… |
CVE-2025-63039 | Medium | 6.5 | 2025-12-18 | Missing Authorization vulnerability in CridioStudio ListingPro listingpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2025-60088 | Medium | 6.5 | 2025-12-18 | Missing Authorization vulnerability in Saleswonder Team: Tobias WebinarIgnition webinar-ignition allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2025-60086 | High | 7.5 | 2025-12-18 | Missing Authorization vulnerability in Matt WP Voting Contest wp-voting-contest allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2025-60079 | High | 7.1 | 2025-12-18 | Missing Authorization vulnerability in bPlugins Parallax Section block parallax-section allows Accessing Functionality Not Properly Constrained by ACLs.This is… |
CVE-2025-60077 | High | 7.5 | 2025-12-18 | Missing Authorization vulnerability in YayCommerce YayPricing yaypricing allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Yay… |
CVE-2025-60045 | High | 7.5 | 2025-12-18 | Missing Authorization vulnerability in ThemeAtelier IDonatePro idonate-pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects I… |
CVE-2025-58938 | High | 7.5 | 2025-12-18 | Missing Authorization vulnerability in ThemeAtelier IDonatePro idonate-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2025-58877 | High | 7.5 | 2025-12-18 | Missing Authorization vulnerability in javothemes Javo Core javo-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2025-54751 | High | 7.1 | 2025-12-18 | Missing Authorization vulnerability in WPXPO PostX ultimate-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pos… |
CVE-2025-54745 | Medium | 6.5 | 2025-12-18 | Missing Authorization vulnerability in miniOrange miniOrange's Google Authenticator miniorange-2-factor-authentication allows Exploiting Incorrectly Configured… |
CVE-2025-54743 | Medium | 5.8 | 2025-12-18 | Missing Authorization vulnerability in mkscripts Download After Email download-after-email allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-54741 | Medium | 6.5 | 2025-12-18 | Missing Authorization vulnerability in Tyler Moore Super Blank super-blank allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2025-49902 | Medium | 6.5 | 2025-12-18 | Missing Authorization vulnerability in A WP Life Login Page Customizer – Customizer Login Page, Admin Page, Custom Design customizer-login-page allows Exploiti… |
CVE-2025-49041 | Medium | 6.5 | 2025-12-18 | Missing Authorization vulnerability in The African Boss Get Cash get-cash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2025-13498 | Medium | 4.3 | 2025-12-18 | The Download Manager plugin for WordPress is vulnerable to unauthorized access of sensitive information in all versions up to, and including, 3.3.32. This is d… |
CVE-2023-53923 | Critical | 9.8 | 2025-12-17 | UliCMS 2023.1 contains a privilege escalation vulnerability that allows unauthenticated attackers to create administrative accounts through the UserController… |
CVE-2025-14817 | Medium | 6.5 | 2025-12-17 | The component com.transsion.tranfacmode.entrance.main.MainActivity in com.transsion.tranfacmode has no permission control and can be accessed by third-party ap… |
CVE-2025-14061 | Medium | 5.3 | 2025-12-17 | The Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) : WP Cookie Consent plugin for WordPress is vulnerab… |
CVE-2025-13750 | Medium | 4.3 | 2025-12-17 | The Converter for Media – Optimize images | Convert WebP & AVIF plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabi… |
CVE-2025-13880 | Medium | 6.5 | 2025-12-17 | The WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets (Google Reviews, YouTube Feed, Photo Feeds, and More) plugin for WordPress is vulnerab… |
CVE-2025-11369 | Medium | 4.3 | 2025-12-17 | The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to unauthorized access of data due to a missin… |
CVE-2025-64520 | Medium | 6.5 | 2025-12-16 | GLPI is a free asset and IT management software package. Starting in version 9.1.0 and prior to version 10.0.21, an unauthorized user with an API access can re… |
CVE-2025-68270 | Critical | 9.9 | 2025-12-16 | The Open edX Platform is a learning management platform. Prior to commit 05d0d0936daf82c476617257aa6c35f0cd4ca060, CourseLimitedStaffRole users are able to acc… |
CVE-2025-13741 | Medium | 4.3 | 2025-12-16 | The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress is vulnerable to unauthoriz… |
CVE-2025-0836 | Medium | 6.3 | 2025-12-16 | Missing Authorization vulnerability in Milestone Systems XProtect VMS allows users with read-only access to Management Server to have full read/write access to… |
CVE-2025-68088 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in merkulove Huger for Elementor huger-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-68087 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in merkulove Modalier for Elementor modalier-elementor allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-68086 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in merkulove Reformer for Elementor reformer-elementor allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-68085 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in merkulove Buttoner for Elementor buttoner-elementor allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-68084 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in Nitesh Ultimate Auction ultimate-auction allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-67976 | Medium | 6.5 | 2025-12-16 | Missing Authorization vulnerability in Bob Watu Quiz watu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Watu Quiz… |
CVE-2025-67965 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in favethemes Homey Core homey-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-67929 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Exploiting Incorrectly Configured Access Control… |
CVE-2025-66167 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in merkulove Lottier lottier-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2025-66166 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in merkulove Lottier for Elementor lottier-elementor allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-66165 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in merkulove Lottier for WPBakery lottier-wpbakery allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-66164 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in merkulove Laser laser allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Laser… |
CVE-2025-66163 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in merkulove Masker for Elementor masker-elementor allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-66162 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in merkulove Spoter for Elementor spoter-elementor allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-66161 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in merkulove Grider for Elementor grider-elementor allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-66147 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in merkulove Coder for Elementor coder-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-66134 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in NinjaTeam FileBird Pro filebird-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2025-66133 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Exploiting Incorrectly Conf… |
CVE-2025-66131 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in yaadsarig Yaad Sarig Payment Gateway For WC yaad-sarig-payment-gateway-for-wc allows Exploiting Incorrectly Configured A… |
CVE-2025-66130 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in etruel WP Views Counter wpecounter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2025-66129 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in wppochipp Pochipp pochipp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Poc… |
CVE-2025-66128 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in Brevo Sendinblue for WooCommerce woocommerce-sendinblue-newsletter-subscription allows Exploiting Incorrectly Configured… |
CVE-2025-66127 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in g5theme Essential Real Estate essential-real-estate allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-66124 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in ZEEN101 Leaky Paywall leaky-paywall allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2025-66122 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in Design Stylish Price List stylish-price-list allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2025-66121 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in SiteGround SiteGround Security sg-security allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-66120 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in CatFolders CatFolders catfolders allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-64639 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in WP Compress WP Compress for MainWP wp-compress-mainwp allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-64638 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in OnPay.io OnPay.io for WooCommerce onpay-io-for-woocommerce allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2025-64635 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in Syed Balkhi Feeds for YouTube feeds-for-youtube allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-64634 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in ThemeFusion Avada avada allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Avada: from n… |
CVE-2025-64632 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in Auctollo Google XML Sitemaps google-sitemap-generator allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-64631 | Medium | 4.9 | 2025-12-16 | Missing Authorization vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-64630 | Medium | 4.9 | 2025-12-16 | Missing Authorization vulnerability in Strategy11 Team Business Directory business-directory-plugin allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2025-64251 | Medium | 4.9 | 2025-12-16 | Missing Authorization vulnerability in azzaroco Ultimate Learning Pro indeed-learning-pro allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2025-64249 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in WP-EXPERTS.IN Protect WP Admin protect-wp-admin allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-64248 | Medium | 4.3 | 2025-12-16 | Missing Authorization vulnerability in emarket-design Request a Quote request-a-quote allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2025-64247 | Medium | 4.3 | 2025-12-16 | Missing Authorization vulnerability in edmon.parker Read More & Accordion expand-maker allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-64246 | Medium | 4.3 | 2025-12-16 | Missing Authorization vulnerability in netopsae Accessibility by AudioEye accessibility-by-audioeye allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2025-64245 | Medium | 4.3 | 2025-12-16 | Missing Authorization vulnerability in ryanpcmcquen Import external attachments import-external-attachments allows Exploiting Incorrectly Configured Access Con… |
CVE-2025-64244 | Medium | 4.3 | 2025-12-16 | Missing Authorization vulnerability in Codexpert, Inc Restrict Elementor Widgets, Columns and Sections restrict-elementor-widgets allows Exploiting Incorrectly… |
CVE-2025-64243 | Medium | 4.3 | 2025-12-16 | Missing Authorization vulnerability in e-plugins Directory Pro directory-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-64242 | Medium | 4.3 | 2025-12-16 | Missing Authorization vulnerability in Merv Barrett Easy Property Listings easy-property-listings allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2025-64241 | Medium | 4.3 | 2025-12-16 | Missing Authorization vulnerability in Imtiaz Rayhan WP Coupons and Deals wp-coupons-and-deals allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-64238 | Medium | 4.3 | 2025-12-16 | Missing Authorization vulnerability in NicolasKulka WPS Bidouille wps-bidouille allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2025-59001 | Medium | 4.3 | 2025-12-16 | Missing Authorization vulnerability in ThemeNectar Salient Core salient-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-54045 | Medium | 4.3 | 2025-12-16 | Missing Authorization vulnerability in CreativeMindsSolutions CM On Demand Search And Replace cm-on-demand-search-and-replace allows Exploiting Incorrectly Con… |
CVE-2025-54005 | Medium | 4.3 | 2025-12-16 | Missing Authorization vulnerability in sonalsinha21 SKT Page Builder skt-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-54004 | Low | 2.7 | 2025-12-16 | Missing Authorization vulnerability in WC Lovers WCFM – Frontend Manager for WooCommerce wc-frontend-manager allows Exploiting Incorrectly Configured Access Co… |
CVE-2025-11991 | Medium | 5.3 | 2025-12-16 | The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t… |
CVE-2025-13794 | Medium | 4.3 | 2025-12-16 | The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the… |
CVE-2025-12809 | Medium | 5.3 | 2025-12-16 | The Dokan Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `/dokan/v1/wholesale/register` REST AP… |
CVE-2025-13956 | Medium | 5.3 | 2025-12-16 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the statistic func… |
CVE-2025-66402 | Medium | 6.5 | 2025-12-16 | Misskey is an open source, federated social media platform. Starting in version 13.0.0-beta.16 and prior to version 2025.12.0, an actor who does not have permi… |
CVE-2025-14038 | High | 7.0 | 2025-12-15 | EDB Hybrid Manager contains a flaw that allows an unauthenticated attacker to directly access certain gRPC endpoints. This could allow an attacker to read pote… |
CVE-2025-65742 | High | 8.2 | 2025-12-15 | An unauthenticated Broken Function Level Authorization (BFLA) vulnerability in Newgen OmniDocs v11.0 allows attackers to obtain sensitive information and execu… |
CVE-2025-14003 | Medium | 4.3 | 2025-12-15 | The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the… |
CVE-2025-13950 | Medium | 5.3 | 2025-12-15 | The OneSignal – Web Push Notifications plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the setting… |
CVE-2025-12900 | Medium | 4.3 | 2025-12-15 | The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to missing authorization in all versions up to, and including… |
CVE-2025-9218 | Low | 3.7 | 2025-12-13 | The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to to Information Disclosure due to missing authorization in the handle_re… |
CVE-2025-14581 | Medium | 4.3 | 2025-12-13 | The HAPPY – Helpdesk Support Ticket System plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the 'submit_form_rep… |
CVE-2025-14540 | Medium | 4.3 | 2025-12-13 | The Userback plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the userback_get_json function in all versi… |
CVE-2025-14508 | Medium | 6.5 | 2025-12-13 | The MediaCommander – Bring Folders to Media, Posts, and Pages plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability chec… |
CVE-2025-14447 | Medium | 4.3 | 2025-12-13 | The AnnunciFunebri Impresa plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the annfu_reset_options… |
CVE-2025-14446 | Medium | 5.4 | 2025-12-13 | The Popup Builder (Easy Notify Lite) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the easynotif… |