CWE-862 · Missing Authorization (page 41)
Page 41 of 100 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-59001 | Medium | 4.3 | 2025-12-16 | Missing Authorization vulnerability in ThemeNectar Salient Core salient-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-54045 | Medium | 4.3 | 2025-12-16 | Missing Authorization vulnerability in CreativeMindsSolutions CM On Demand Search And Replace cm-on-demand-search-and-replace allows Exploiting Incorrectly Con… |
CVE-2025-54005 | Medium | 4.3 | 2025-12-16 | Missing Authorization vulnerability in sonalsinha21 SKT Page Builder skt-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-54004 | Low | 2.7 | 2025-12-16 | Missing Authorization vulnerability in WC Lovers WCFM – Frontend Manager for WooCommerce wc-frontend-manager allows Exploiting Incorrectly Configured Access Co… |
CVE-2025-11991 | Medium | 5.3 | 2025-12-16 | The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t… |
CVE-2025-13794 | Medium | 4.3 | 2025-12-16 | The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the… |
CVE-2025-12809 | Medium | 5.3 | 2025-12-16 | The Dokan Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `/dokan/v1/wholesale/register` REST AP… |
CVE-2025-13956 | Medium | 5.3 | 2025-12-16 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the statistic func… |
CVE-2025-66402 | Medium | 6.5 | 2025-12-16 | Misskey is an open source, federated social media platform. Starting in version 13.0.0-beta.16 and prior to version 2025.12.0, an actor who does not have permi… |
CVE-2025-14038 | High | 7.0 | 2025-12-15 | EDB Hybrid Manager contains a flaw that allows an unauthenticated attacker to directly access certain gRPC endpoints. This could allow an attacker to read pote… |
CVE-2025-65742 | High | 8.2 | 2025-12-15 | An unauthenticated Broken Function Level Authorization (BFLA) vulnerability in Newgen OmniDocs v11.0 allows attackers to obtain sensitive information and execu… |
CVE-2025-14003 | Medium | 4.3 | 2025-12-15 | The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the… |
CVE-2025-13950 | Medium | 5.3 | 2025-12-15 | The OneSignal – Web Push Notifications plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the setting… |
CVE-2025-12900 | Medium | 4.3 | 2025-12-15 | The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to missing authorization in all versions up to, and including… |
CVE-2025-9218 | Low | 3.7 | 2025-12-13 | The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to to Information Disclosure due to missing authorization in the handle_re… |
CVE-2025-14581 | Medium | 4.3 | 2025-12-13 | The HAPPY – Helpdesk Support Ticket System plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the 'submit_form_rep… |
CVE-2025-14540 | Medium | 4.3 | 2025-12-13 | The Userback plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the userback_get_json function in all versi… |
CVE-2025-14508 | Medium | 6.5 | 2025-12-13 | The MediaCommander – Bring Folders to Media, Posts, and Pages plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability chec… |
CVE-2025-14447 | Medium | 4.3 | 2025-12-13 | The AnnunciFunebri Impresa plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the annfu_reset_options… |
CVE-2025-14446 | Medium | 5.4 | 2025-12-13 | The Popup Builder (Easy Notify Lite) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the easynotif… |
CVE-2025-14397 | High | 8.8 | 2025-12-13 | The Postem Ipsum plugin for WordPress is vulnerable to unauthorized modification of data to Privilege Escalation due to a missing capability check on the poste… |
CVE-2025-14395 | Medium | 4.3 | 2025-12-13 | The Popover Windows plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple ajax actions (e.g., p… |
CVE-2025-14367 | Medium | 5.3 | 2025-12-13 | The Easy Theme Options plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0. This is due to missing authorizat… |
CVE-2025-14366 | Medium | 5.3 | 2025-12-13 | The Eyewear prescription form plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.0.1. This is due to missing a… |
CVE-2025-14365 | Medium | 5.3 | 2025-12-13 | The Eyewear prescription form plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.0.1. This is due to missing c… |
CVE-2025-14288 | Medium | 4.3 | 2025-12-13 | The Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery plugin for WordPress is vulnerabl… |
CVE-2025-13403 | Medium | 4.3 | 2025-12-13 | The Employee Spotlight – Team Member Showcase & Meet the Team Plugin for WordPress is vulnerable to unauthorized tracking settings modification due to missing… |
CVE-2025-13093 | Medium | 5.3 | 2025-12-13 | The Devs CRM – Manage tasks, attendance and teams all together plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabil… |
CVE-2025-13092 | Medium | 5.3 | 2025-12-13 | The Devs CRM – Manage tasks, attendance and teams all together plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability ch… |
CVE-2025-12362 | Medium | 5.3 | 2025-12-13 | The myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program plugin for WordPress is vulnerable to Missing Authorization in versi… |
CVE-2025-11164 | Medium | 4.3 | 2025-12-13 | The Mavix Education theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mavix_education_activate_p… |
CVE-2025-43497 | Medium | 5.2 | 2025-12-12 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be able to break out of its sandbox. |
CVE-2025-14065 | Medium | 4.3 | 2025-12-12 | The Simple Bike Rental plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'simpbire_carica_prenotazioni… |
CVE-2025-14074 | Medium | 4.3 | 2025-12-12 | The PDF for Contact Form 7 + Drag and Drop Template Builder plugin for WordPress is vulnerable to unauthorized post duplication due to a missing capability che… |
CVE-2025-10583 | Low | 3.5 | 2025-12-12 | The WP Fastest Cache Premium plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.7.4 via the 'get_server_… |
CVE-2025-67737 | Low | 3.1 | 2025-12-12 | AzuraCast is a self-hosted, all-in-one web radio management suite. Versions 0.23.1 mistakenly include an API endpoint that is intended for internal use by the… |
CVE-2025-12655 | Medium | 5.3 | 2025-12-12 | The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to arbitrary file write via a missing authorization check in all versions up to, and i… |
CVE-2025-14392 | Medium | 4.3 | 2025-12-12 | The Simple Theme Changer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the user_theme_admin, dis… |
CVE-2025-14170 | Medium | 4.3 | 2025-12-12 | The Vimeo SimpleGallery plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 0.2. This is due to missing authoriza… |
CVE-2025-14064 | Medium | 5.4 | 2025-12-12 | The BuddyTask plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on multiple AJAX endpoints i… |
CVE-2025-14045 | Medium | 4.3 | 2025-12-12 | The URL Media Uploader plugin for WordPress is vulnerable to unauthorized safe file uploads due to a missing capability check on the url_media_uploader_url_upl… |
CVE-2025-13866 | Medium | 6.4 | 2025-12-12 | The Flow-Flow Social Feed Stream plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the flow_flow_soc… |
CVE-2025-13440 | Medium | 5.3 | 2025-12-12 | The Premmerce Wishlist for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.1.10. This is due to… |
CVE-2025-13334 | High | 8.1 | 2025-12-12 | The Blaze Demo Importer plugin for WordPress is vulnerable to unauthorized database resets and file deletion due to a missing capability check on the "blaze_de… |
CVE-2025-13314 | Medium | 5.3 | 2025-12-12 | The Product Filtering by Categories, Tags, Price Range for WooCommerce – Filter Plus plugin for WordPress is vulnerable to unauthorized modification of data in… |
CVE-2025-12963 | Critical | 9.8 | 2025-12-12 | The LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart plugin for WordPress is vulnerable to privilege escalation via account tak… |
CVE-2025-12783 | Medium | 4.3 | 2025-12-12 | The Premmerce Brands for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveBrand… |
CVE-2023-53740 | Critical | 9.8 | 2025-12-10 | Screen SFT DAB 1.9.3 contains an authentication bypass vulnerability that allows attackers to change the admin password without providing the current credentia… |
CVE-2020-36902 | Critical | 9.8 | 2025-12-10 | UBICOD Medivision Digital Signage 1.5.1 contains an authorization bypass vulnerability that allows normal users to escalate privileges by manipulating the 'ft[… |
CVE-2025-67636 | Medium | 4.3 | 2025-12-10 | A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypted password values i… |
CVE-2021-47701 | High | 8.8 | 2025-12-09 | OpenBMCS 2.4 allows an attacker to escalate privileges from a read user to an admin user by manipulating permissions and exploiting a vulnerability in the upda… |
CVE-2023-23729 | Medium | 5.4 | 2025-12-09 | Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spec… |
CVE-2022-47425 | Medium | 4.3 | 2025-12-09 | Missing Authorization vulnerability in Repute Infosystems ARMember allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects A… |
CVE-2022-46845 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in Essential Plugin Slider a SlidersPack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-67599 | Medium | 4.3 | 2025-12-09 | Missing Authorization vulnerability in WebToffee WebToffee eCommerce Marketing Automation decorator-woocommerce-email-customizer allows Exploiting Incorrectly… |
CVE-2025-67597 | Medium | 4.3 | 2025-12-09 | Missing Authorization vulnerability in Shahjahan Jewel Fluent Booking fluent-booking allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-67592 | Medium | 4.3 | 2025-12-09 | Missing Authorization vulnerability in Joe Dolson My Calendar my-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2025-67589 | Medium | 4.3 | 2025-12-09 | Missing Authorization vulnerability in WP Overnight WooCommerce PDF Invoices & Packing Slips woocommerce-pdf-invoices-packing-slips allows Exploiting Incorrect… |
CVE-2025-67588 | Medium | 4.3 | 2025-12-09 | Missing Authorization vulnerability in Elementor Elementor Website Builder elementor allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-67586 | Medium | 4.7 | 2025-12-09 | Missing Authorization vulnerability in Ronald Huereca Highlight and Share highlight-and-share allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-67584 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in rtCamp GoDAM godam allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GoDAM: fro… |
CVE-2025-67583 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in Foysal Imran IDonate idonate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-67582 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in wbcomdesigns Wbcom Designs lock-my-bp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-67581 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in themetechmount TrueBooker truebooker-appointment-booking allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2025-67580 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in Constant Contact Constant Contact + WooCommerce constant-contact-woocommerce allows Exploiting Incorrectly Configured Ac… |
CVE-2025-67579 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-67578 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in Rhys Wynne WP Email Capture wp-email-capture allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2025-67577 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in hassantafreshi Easy Form Builder easy-form-builder allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2025-67576 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in QuantumCloud Simple Link Directory simple-link-directory allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2025-67575 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in Andrew Lima Sitewide Notice WP sitewide-notice-wp allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-67574 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Exploiting Incorrectly Configured Access C… |
CVE-2025-67573 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in ThimPress Sailing sailing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sai… |
CVE-2025-67572 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in PenciDesign PenNews pennews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects P… |
CVE-2025-67571 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in WPFunnels WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-67570 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in WesternDeal WPForms Google Sheet Connector gsheetconnector-wpforms allows Exploiting Incorrectly Configured Access Contr… |
CVE-2025-67569 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in scriptsbundle AdForest adforest allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2025-67568 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in xtemos Basel basel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Basel: fro… |
CVE-2025-67566 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in WofficeIO Woffice Core woffice-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2025-67563 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in Saad Iqbal Post SMTP post-smtp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2025-67562 | Medium | 5.4 | 2025-12-09 | Missing Authorization vulnerability in WebCodingPlace Image Caption Hover Pro image-caption-hover-pro allows Exploiting Incorrectly Configured Access Control S… |
CVE-2025-67561 | Medium | 5.4 | 2025-12-09 | Missing Authorization vulnerability in Oleksandr Lysyi Debug Log Viewer debug-log-viewer allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-67560 | Medium | 5.4 | 2025-12-09 | Missing Authorization vulnerability in Webilia Inc. Listdom listdom allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-67559 | Medium | 5.4 | 2025-12-09 | Missing Authorization vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Exploiting Incorrect… |
CVE-2025-67548 | Medium | 6.5 | 2025-12-09 | Missing Authorization vulnerability in WP Delicious WP Delicious delicious-recipes allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-67540 | Medium | 6.5 | 2025-12-09 | Missing Authorization vulnerability in Wealcoder Animation Addons for Elementor animation-addons-for-elementor allows Exploiting Incorrectly Configured Access… |
CVE-2025-67474 | Medium | 4.3 | 2025-12-09 | Missing Authorization vulnerability in Ultimate Member ForumWP forumwp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2025-67468 | Medium | 4.3 | 2025-12-09 | Missing Authorization vulnerability in CRM Perks Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms cf7-salesforce allo… |
CVE-2025-67466 | Medium | 4.3 | 2025-12-09 | Missing Authorization vulnerability in sergiotrinity Trinity Audio trinity-audio allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-66534 | Medium | 4.3 | 2025-12-09 | Missing Authorization vulnerability in Elated-Themes The Aisle theaisle allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-66532 | Medium | 4.3 | 2025-12-09 | Missing Authorization vulnerability in Mikado-Themes Powerlift powerlift allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2025-66530 | Medium | 4.3 | 2025-12-09 | Missing Authorization vulnerability in Webba Appointment Booking Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2025-66528 | Medium | 4.3 | 2025-12-09 | Missing Authorization vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Exploiting Incorrectly Configu… |
CVE-2025-66527 | Medium | 4.3 | 2025-12-09 | Missing Authorization vulnerability in VanKarWai Lobo lobo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lobo: fro… |
CVE-2025-66526 | Medium | 4.3 | 2025-12-09 | Missing Authorization vulnerability in Essekia Tablesome tablesome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects T… |
CVE-2025-66525 | Medium | 4.3 | 2025-12-09 | Missing Authorization vulnerability in Elastic Email Elastic Email Sender elastic-email-sender allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-64257 | Medium | 4.3 | 2025-12-09 | Missing Authorization vulnerability in Joe Dolson My Tickets my-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-64255 | Low | 2.7 | 2025-12-09 | Missing Authorization vulnerability in Bowo Admin and Site Enhancements (ASE) admin-site-enhancements allows Exploiting Incorrectly Configured Access Control S… |
CVE-2025-64254 | Low | 2.7 | 2025-12-09 | Missing Authorization vulnerability in Ronald Huereca Photo Block photo-block allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2025-63077 | Medium | 4.3 | 2025-12-09 | Missing Authorization vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control S… |
CVE-2025-63069 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in Vinod Dalvi Ivory Search add-search-to-menu allows Exploiting Incorrectly Configured Access Control Security Levels.This… |