Harry Nguyen

The CURCY – Multi Currency for WooCommerce plugin for WordPress contains a missing authorization flaw resulting from an incorrectly configured access control security level. Specifically, a missing capability check in a function allows unauthenticated attackers to perform unauthorized actions.

Missing authorization in the Mailchimp for WordPress plugin allows attackers to exploit incorrectly configured access control security levels. This occurs due to a missing capability check on a function, enabling unauthenticated attackers to perform unauthorized actions.

Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts into pages, which execute when a user accesses the affected page.

Incorrectly configured access control security levels allow authenticated attackers with instructor-level access and above to perform unauthorized actions. This occurs due to a missing capability check within a function.