CWE-862 · Missing Authorization (page 43)
Page 43 of 100 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-13318 | Medium | 5.3 | 2025-11-22 | The Booking Calendar Contact Form plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.2.60. This is due to miss… |
CVE-2025-13136 | Medium | 4.3 | 2025-11-22 | The GSheetConnector For Ninja Forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'njform-google-s… |
CVE-2025-13384 | High | 7.5 | 2025-11-22 | The CP Contact Form with PayPal plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.56. This is due to the pl… |
CVE-2025-13317 | Medium | 5.3 | 2025-11-22 | The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.96. This is due to the p… |
CVE-2025-12877 | Medium | 5.3 | 2025-11-22 | The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized modification od data due to a missing capa… |
CVE-2025-66114 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in theme funda Show Variations as Single Products Woocommerce woo-show-single-variations-shop-category allows Exploiting In… |
CVE-2025-66113 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in ThemeAtelier Better Chat Support for Messenger better-chat-support allows Exploiting Incorrectly Configured Access Contr… |
CVE-2025-66112 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in WebToffee Accessibility Toolkit by WebYes accessibility-plus allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2025-66110 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in bPlugins Tiktok Feed b-tiktok-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2025-66109 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in Octolize Shipping Plugins Cart Weight for WooCommerce woo-cart-weight allows Exploiting Incorrectly Configured Access Co… |
CVE-2025-66108 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in Merlot Digital (by TNC) TNC Toolbox: Web Performance tnc-toolbox allows Exploiting Incorrectly Configured Access Control… |
CVE-2025-66107 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in Scott Paterson Subscriptions & Memberships for PayPal subscriptions-memberships-for-paypal allows Exploiting Incorrectly… |
CVE-2025-66106 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in Essential Plugin Featured Post Creative featured-post-creative allows Exploiting Incorrectly Configured Access Control S… |
CVE-2025-66101 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in Sabuj Kundu CBX Bookmark & Favorite cbxwpbookmark allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-66099 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in ThemeAtelier Chat Help chat-help allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-66096 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in Imtiaz Rayhan Table Block by Tableberg tableberg allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-66089 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in WebToffee Product Feed for WooCommerce webtoffee-product-feed allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2025-66087 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in Property Hive PropertyHive propertyhive allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2025-66086 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-66085 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2025-66084 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in Shahjahan Jewel FluentCommunity fluent-community allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-66083 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in magepeopleteam WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2025-66082 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in magepeopleteam WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2025-66079 | Medium | 6.5 | 2025-11-21 | Missing Authorization vulnerability in Jegstudio Gutenverse Form gutenverse-form allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-66077 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in wpWax Legal Pages legal-pages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-66075 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Exploiting Incorrectly Conf… |
CVE-2025-66072 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Users… |
CVE-2025-66071 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in tychesoftwares Custom Order Numbers for WooCommerce custom-order-numbers-for-woocommerce allows Exploiting Incorrectly C… |
CVE-2025-66069 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in Themeisle PPOM for WooCommerce woocommerce-product-addon allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2025-66065 | Medium | 6.5 | 2025-11-21 | Missing Authorization vulnerability in Jegstudio Gutenverse gutenverse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2025-66063 | Medium | 5.4 | 2025-11-21 | Missing Authorization vulnerability in jgwhite33 WP Google Review Slider wp-google-places-review-slider allows Exploiting Incorrectly Configured Access Control… |
CVE-2025-66060 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Con… |
CVE-2025-10054 | Medium | 4.3 | 2025-11-21 | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che… |
CVE-2025-13149 | Medium | 4.3 | 2025-11-21 | The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress is vulnerable to unauthoriz… |
CVE-2025-12170 | Medium | 5.3 | 2025-11-21 | The Checkbox plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wp_ajax_nopriv_checkbox_clean_log' AJAX… |
CVE-2025-11985 | High | 8.8 | 2025-11-21 | The Realty Portal plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability che… |
CVE-2025-11773 | Medium | 4.3 | 2025-11-21 | The Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO plugin for WordPress is vulnerable to unauthorized modification of data due to… |
CVE-2025-11003 | Medium | 6.4 | 2025-11-21 | The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missin… |
CVE-2025-10938 | Medium | 6.5 | 2025-11-21 | The UiPress lite plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.08. This is due to missing capa… |
CVE-2025-9825 | Medium | 5.0 | 2025-11-21 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 to 18.2.8, 18.3 before 18.3.4, and 18.4 before 18.4.2 that could have allowed a… |
CVE-2025-12169 | Medium | 4.3 | 2025-11-21 | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che… |
CVE-2025-12085 | Medium | 4.3 | 2025-11-21 | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che… |
CVE-2025-12023 | Medium | 4.3 | 2025-11-21 | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che… |
CVE-2025-12022 | Medium | 4.3 | 2025-11-21 | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che… |
CVE-2025-52670 | Medium | 6.5 | 2025-11-20 | Missing authorization check in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes users on the system to delete banners owned by other accounts |
CVE-2025-62293 | Medium | 5.4 | 2025-11-20 | SOPlanning is vulnerable to Broken Access Control in /status endpoint. Due to lack of permission checks in Project Status functionality an authenticated attack… |
CVE-2025-13468 | Medium | 5.4 | 2025-11-20 | A weakness has been identified in SourceCodester Alumni Management System 1.0. This issue affects the function delete_forum/delete_career/delete_comment/delete… |
CVE-2025-12778 | Medium | 5.3 | 2025-11-20 | The Ultimate Member Widgets for Elementor – WordPress User Directory plugin for WordPress is vulnerable to unauthorized access of data due to a missing capabil… |
CVE-2025-65089 | Medium | 6.8 | 2025-11-19 | XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to version 1.27.0, a user with no view rights… |
CVE-2025-65029 | High | 8.1 | 2025-11-19 | Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an insecure direct object reference (IDOR) vulnerability allows any authent… |
CVE-2025-65028 | Medium | 6.5 | 2025-11-19 | Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an insecure direct object reference (IDOR) vulnerability allows any authent… |
CVE-2025-65021 | Critical | 9.1 | 2025-11-19 | Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference (IDOR) vulnerability exists in the poll… |
CVE-2025-65020 | Medium | 6.5 | 2025-11-19 | Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference (IDOR) vulnerability in the poll duplic… |
CVE-2025-12822 | Medium | 4.3 | 2025-11-19 | The WP Login and Register using JWT plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'mo_jwt_generate… |
CVE-2025-12751 | Medium | 4.3 | 2025-11-19 | The WSChat – WordPress Live Chat plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'reset_settin… |
CVE-2025-12174 | Medium | 6.5 | 2025-11-19 | The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to unauthorized access due to a missing c… |
CVE-2025-12955 | High | 7.5 | 2025-11-18 | The Live sales notification for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.3.39. This is d… |
CVE-2025-12639 | Medium | 4.3 | 2025-11-18 | The wModes – Catalog Mode, Product Pricing, Enquiry Forms & Promotions plugin for WordPress is vulnerable to authorization bypass in versions up to, and includ… |
CVE-2025-12481 | Medium | 4.3 | 2025-11-18 | The WP Duplicate Page plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.7. This is due to the plugin not prop… |
CVE-2025-12392 | Medium | 5.3 | 2025-11-18 | The Cryptocurrency Payment Gateway for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on… |
CVE-2025-12391 | Medium | 5.3 | 2025-11-18 | The Restrictions for BuddyPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_optin_o… |
CVE-2025-11734 | Medium | 5.4 | 2025-11-18 | The Broken Link Checker by AIOSEO – Easily Fix/Monitor Internal and External links plugin for WordPress is vulnerable to unauthorized post modification due to… |
CVE-2025-12961 | Medium | 4.3 | 2025-11-18 | The Download Panel plugin for WordPress is vulnerable to unauthorized settings modification due to a missing capability check on the 'wp_ajax_save_settings' AJ… |
CVE-2025-12937 | Medium | 6.5 | 2025-11-18 | The ACF Flexible Layouts Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'acf_flm_upda… |
CVE-2025-12372 | Medium | 4.3 | 2025-11-18 | The Permalinks Cascade plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.2. This is due to the plugin not pro… |
CVE-2025-11620 | High | 7.2 | 2025-11-18 | The Multiple Roles per User plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mrpu_add_multiple… |
CVE-2025-6171 | Medium | 5.3 | 2025-11-15 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.2 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allow… |
CVE-2025-12849 | Medium | 5.3 | 2025-11-15 | The Contest Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 28.0.2. This is due to the plugin register… |
CVE-2025-12847 | Medium | 4.3 | 2025-11-15 | The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to unauthorized arbitrary media attachment… |
CVE-2025-13179 | Medium | 4.3 | 2025-11-14 | A vulnerability has been found in Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System up to 20250320. This issue affects some unknown… |
CVE-2025-13177 | Medium | 4.3 | 2025-11-14 | A vulnerability was detected in Bdtask/CodeCanyon SalesERP up to 20250728. This affects an unknown part. The manipulation results in cross-site request forgery… |
CVE-2025-13119 | Medium | 4.3 | 2025-11-13 | A flaw has been found in Fabian Ros/SourceCodester Simple E-Banking System 1.0. This affects an unknown part. This manipulation causes cross-site request forge… |
CVE-2025-12817 | Low | 3.1 | 2025-11-13 | Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creati… |
CVE-2025-12377 | Medium | 4.3 | 2025-11-13 | The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che… |
CVE-2025-64384 | Medium | 5.3 | 2025-11-13 | Missing Authorization vulnerability in jetmonsters JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-64382 | Medium | 4.3 | 2025-11-13 | Missing Authorization vulnerability in WebToffee Order Export & Order Import for WooCommerce order-import-export-for-woocommerce allows Exploiting Incorrectly… |
CVE-2025-64379 | Medium | 4.3 | 2025-11-13 | Missing Authorization vulnerability in Pluggabl Booster for WooCommerce woocommerce-jetpack allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2025-64370 | Medium | 5.3 | 2025-11-13 | Missing Authorization vulnerability in YOP YOP Poll yop-poll allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YOP Pol… |
CVE-2025-64369 | Medium | 6.5 | 2025-11-13 | Missing Authorization vulnerability in codepeople Contact Form Email contact-form-to-email allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-64277 | Medium | 5.3 | 2025-11-13 | Missing Authorization vulnerability in QuantumCloud ChatBot chatbot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-64276 | Medium | 6.5 | 2025-11-13 | Missing Authorization vulnerability in Ays Pro Survey Maker survey-maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2025-64274 | Medium | 4.3 | 2025-11-13 | Missing Authorization vulnerability in wpkoithemes WPKoi Templates for Elementor wpkoi-templates-for-elementor allows Exploiting Incorrectly Configured Access… |
CVE-2025-64269 | Medium | 4.3 | 2025-11-13 | Missing Authorization vulnerability in EDGARROJAS WooCommerce PDF Invoice Builder woo-pdf-invoice-builder allows Exploiting Incorrectly Configured Access Contr… |
CVE-2025-64265 | Medium | 4.3 | 2025-11-13 | Missing Authorization vulnerability in N-Media Frontend File Manager nmedia-user-file-uploader allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-64263 | Medium | 5.4 | 2025-11-13 | Missing Authorization vulnerability in PluginEver WP Content Pilot wp-content-pilot allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2025-64261 | Medium | 5.4 | 2025-11-13 | Missing Authorization vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows Exploiting Incorrectly Configured Access Con… |
CVE-2025-64259 | Medium | 5.3 | 2025-11-13 | Missing Authorization vulnerability in Jeroen Schmit Theater for WordPress theatre allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-12015 | Medium | 4.3 | 2025-11-13 | The Convert WebP & AVIF | Quicq | Best image optimizer and compression plugin | Improve your Google Pagespeed plugin for WordPress is vulnerable to unauthorize… |
CVE-2025-12891 | Medium | 5.3 | 2025-11-13 | The Survey Maker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ays_survey_show_results' AJAX endp… |
CVE-2025-12979 | Medium | 5.3 | 2025-11-13 | The Welcart e-Commerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'usces_export' action in all… |
CVE-2025-12892 | Medium | 5.3 | 2025-11-13 | The Survey Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deactivate_plugin_option() fu… |
CVE-2025-13063 | High | 7.3 | 2025-11-12 | A flaw has been found in DinukaNavaratna Dee Store 1.0. Affected is an unknown function. Executing manipulation can lead to missing authorization. The attack m… |
CVE-2025-64407 | Medium | 5.3 | 2025-11-12 | Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would ca… |
CVE-2025-64405 | High | 7.5 | 2025-11-12 | Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would ca… |
CVE-2025-64404 | High | 7.5 | 2025-11-12 | Apache OpenOffice documents can contain links to other files. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a documen… |
CVE-2025-64403 | High | 8.1 | 2025-11-12 | Apache OpenOffice Calc spreadsheet can contain links to other files, in the form of "external data sources". A missing Authorization vulnerability in Apache Op… |
CVE-2025-64402 | Medium | 6.5 | 2025-11-12 | Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would ca… |
CVE-2025-64401 | High | 7.5 | 2025-11-12 | Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would ca… |
CVE-2025-12633 | High | 7.5 | 2025-11-12 | The Booking Calendar | Appointment Booking | Bookit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o… |
CVE-2025-12113 | Medium | 4.3 | 2025-11-12 | The Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images plugin for WordPress is vulnerable to unauthorized loss of data due to a missing c… |