Legion Hunter

Missing Authorization vulnerability in WebToffee Product Import Export for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Product Import Export for WooCommerce: from n/a through 2.5.6.

**Name of the Vulnerable Software and Affected Versions** RepairBuddy versions prior to 4.1121 **Description** A missing authorization issue in Webful Creations RepairBuddy allows for the exploitation of incorrectly configured access control security levels. **Recommendations** Update to a version later than 4.1121.

**Name of the Vulnerable Software and Affected Versions** Autoship Cloud for WooCommerce Subscription Products versions prior to 2.14.1 **Description** A missing authorization issue exists in the Autoship Cloud for WooCommerce Subscription Products plugin, which allows for the exploitation of incorrectly configured access control security levels. This is a broken access control flaw where the system fails to properly verify the identity or permissions of a user before granting access to restricted resources. **Recommendations** Update to a version later than 2.14.0.

**Name of the Vulnerable Software and Affected Versions** WP Search Analytics versions prior to 1.5.0 **Description** A missing authorization issue in the plugin allows for the exploitation of incorrectly configured access control security levels, resulting in broken access control. **Recommendations** Update to version 1.5.0 or later.

Missing Authorization vulnerability in Nikki Blight QR Redirector allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects QR Redirector: from n/a through 2.0.3.

**Name of the Vulnerable Software and Affected Versions** Feeds for YouTube versions prior to 2.6.4 **Description** A missing capability check in the `actions()` function allows users with subscriber privileges or higher to unauthorizedly modify or delete the plugin license key. **Recommendations** Update to version 2.6.4 or later. As a temporary workaround, restrict access to the `actions()` function to only authorized administrative users.

**Name of the Vulnerable Software and Affected Versions** Barcode Scanner with Inventory & Order Manager versions prior to 1.11.0 **Description** A Cross-Site Request Forgery (CSRF) flaw exists in the Barcode Scanner with Inventory & Order Manager. This issue allows an attacker to induce a user to perform actions they did not intend to do by tricking them into clicking a malicious link or visiting a compromised page. **Recommendations** Update to a version later than 1.11.0.

Name of the Vulnerable Software and Affected Versions Eniture technology LTL Freight Quotes – Worldwide Express Edition versions through 5.2.1 Description A missing authorization issue exists in Eniture technology LTL Freight Quotes – Worldwide Express Edition due to incorrectly configured access control security levels. Recommendations Update to a version later than 5.2.1

**Name of the Vulnerable Software and Affected Versions** Funlus Oy WPLifeCycle versions through 3.3.1 **Description** An authorization issue exists in Funlus Oy WPLifeCycle free-php-version-info, allowing exploitation due to incorrectly configured access control security levels. **Recommendations** Versions prior to 3.3.1 should be updated.

**Name of the Vulnerable Software and Affected Versions** Chocolate House versions through 1.1.5 **Description** A missing authorization issue exists in Chocolate House, allowing exploitation of incorrectly configured access control security levels. **Recommendations** Update Chocolate House to a version later than 1.1.5.

**Name of the Vulnerable Software and Affected Versions** Aryan Shirani Bid Abadi Site Suggest versions through 1.3.9 **Description** The software contains a missing authorization flaw in the `site-suggest` functionality. This allows access to functionality that is not properly restricted by Access Control Lists (ACLs). **Recommendations** Update to a version later than 1.3.9.

**Name of the Vulnerable Software and Affected Versions** Print Invoice & Delivery Notes for WooCommerce versions through 5.8.0 **Description** The software contains a flaw related to incorrectly configured access control security levels, potentially allowing unauthorized access. The issue is a missing authorization check. **Recommendations** Update Print Invoice & Delivery Notes for WooCommerce to a version newer than 5.8.0.

**Name of the Vulnerable Software and Affected Versions** PDF for Elementor Forms + Drag And Drop Template Builder versions through 6.3.1 **Description** A missing authorization issue exists in PDF for Elementor Forms + Drag And Drop Template Builder. The issue involves exploiting incorrectly configured access control security levels within the add-on. **Recommendations** Update PDF for Elementor Forms + Drag And Drop Template Builder to a version newer than 6.3.1.

**Name of the Vulnerable Software and Affected Versions** CryoutCreations Serious Slider versions through 1.2.7 **Description** A missing authorization issue exists in CryoutCreations Serious Slider, allowing exploitation of incorrectly configured access control security levels. **Recommendations** Update CryoutCreations Serious Slider to a version later than 1.2.7.

**Name of the Vulnerable Software and Affected Versions** WiserReview Product Reviews for WooCommerce versions through 2.9 **Description** An issue exists in WiserReview Product Reviews for WooCommerce related to incorrectly configured access control security levels, potentially allowing unauthorized access. The issue involves a missing authorization check. **Recommendations** Update WiserReview Product Reviews for WooCommerce to a version newer than 2.9.

**Name of the Vulnerable Software and Affected Versions** SeedProd Coming Soon Page, Under Construction & Maintenance Mode versions through 6.19.7 **Description** A missing authorization issue exists in SeedProd Coming Soon Page, Under Construction & Maintenance Mode. This allows exploitation due to incorrectly configured access control security levels. **Recommendations** Update SeedProd Coming Soon Page, Under Construction & Maintenance Mode to a version later than 6.19.7.

**Name of the Vulnerable Software and Affected Versions** Cookiebot versions through 4.6.4 **Description** An issue exists in Cookiebot related to incorrectly configured access control security levels, allowing for missing authorization. The vulnerability allows exploitation of access control. **Recommendations** Update Cookiebot to a version later than 4.6.4.

**Name of the Vulnerable Software and Affected Versions** BBR Plugins Better Business Reviews versions through 0.1.1 **Description** The software contains a missing authorization issue related to incorrectly configured access control security levels. This allows for exploitation of the system. **Recommendations** Update BBR Plugins Better Business Reviews to a version later than 0.1.1.

**Name of the Vulnerable Software and Affected Versions** Endless Posts Navigation versions through 2.2.9 **Description** An authorization issue exists in Endless Posts Navigation that allows exploitation of incorrectly configured access control security levels. **Recommendations** Update Endless Posts Navigation to a version later than 2.2.9.

**Name of the Vulnerable Software and Affected Versions** Advanced iFrame versions prior to and including 2025.10 **Description** An authorization issue exists in Advanced iFrame, potentially allowing exploitation due to incorrectly configured access control security levels. **Recommendations** Update Advanced iFrame to a version later than 2025.10.