Filtered by CWE-639
Filtered by vendor Subscriptions
Total 1601 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-51503 1 Automattic 1 Woopayments 2026-04-28 5.9 Medium
Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 6.9.2.
CVE-2023-51502 1 Automattic 1 Woocommerce Stripe 2026-04-28 7.5 High
Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Stripe Payment Gateway.This issue affects WooCommerce Stripe Payment Gateway: from n/a through 7.6.1.
CVE-2023-49812 1 Wppa 1 Wp Photo Album Plus 2026-04-28 5.3 Medium
Authorization Bypass Through User-Controlled Key vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus.This issue affects WP Photo Album Plus: from n/a through 8.5.02.005.
CVE-2023-49765 1 Blazzdev 1 Rate My Post 2026-04-28 4.3 Medium
Authorization Bypass Through User-Controlled Key vulnerability in Blaz K. Rate my Post – WP Rating System.This issue affects Rate my Post – WP Rating System: from n/a through 3.4.1.
CVE-2023-47191 1 Kainelabs 1 Youzify 2026-04-28 6.5 Medium
Authorization Bypass Through User-Controlled Key vulnerability in KaineLabs Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress.This issue affects Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress: from n/a through 1.2.2.
CVE-2023-46311 1 Gvectors 1 Wpdiscuz 2026-04-28 2.7 Low
Authorization Bypass Through User-Controlled Key vulnerability in gVectors Team Comments – wpDiscuz.This issue affects Comments – wpDiscuz: from n/a through 7.6.3.
CVE-2023-41796 1 Sunshinephotocart 1 Sunshine Photo Cart 2026-04-28 5.3 Medium
Authorization Bypass Through User-Controlled Key vulnerability in WP Sunshine Sunshine Photo Cart: Free Client Galleries for Photographers.This issue affects Sunshine Photo Cart: Free Client Galleries for Photographers: from n/a before 3.0.0.
CVE-2023-38513 1 Meowapps 1 Photo Engine 2026-04-28 5.4 Medium
Authorization Bypass Through User-Controlled Key vulnerability in Jordy Meow Photo Engine (Media Organizer & Lightroom).This issue affects Photo Engine (Media Organizer & Lightroom): from n/a through 6.2.5.
CVE-2023-37871 1 Automattic 1 Woocommerce Gocardless 2026-04-28 8.2 High
Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce GoCardless.This issue affects GoCardless: from n/a through 2.5.6.
CVE-2023-36520 1 Zackgrossbart 1 Editorial Calendar 2026-04-28 5.4 Medium
Authorization Bypass Through User-Controlled Key vulnerability in MarketingFire Editorial Calendar.This issue affects Editorial Calendar: from n/a through 3.7.12.
CVE-2023-35916 1 Automattic 1 Woopayments 2026-04-28 7.5 High
Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 5.9.0.
CVE-2023-35914 1 Automattic 1 Woocommerce Subscriptions 2026-04-28 7.5 High
Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce Woo Subscriptions.This issue affects Woo Subscriptions: from n/a through 5.1.2.
CVE-2023-35876 1 Automattic 1 Woocommerce Square 2026-04-28 8.1 High
Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Square.This issue affects WooCommerce Square: from n/a through 3.8.1.
CVE-2023-32799 1 Woocommerce 1 Shipping Multiple Addresses 2026-04-28 6.5 Medium
Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce Shipping Multiple Addresses.This issue affects Shipping Multiple Addresses: from n/a through 3.8.3.
CVE-2023-32747 1 Automattic 1 Woocommerce Bookings 2026-04-28 5.4 Medium
Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Bookings.This issue affects WooCommerce Bookings: from n/a through 1.15.78.
CVE-2023-23679 1 Jshelpdesk 1 Jshelpdesk 2026-04-28 4.6 Medium
Authorization Bypass Through User-Controlled Key vulnerability in JS Help Desk js-support-ticket allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JS Help Desk: from n/a through 2.7.7.
CVE-2022-43450 1 Xwp 1 Stream 2026-04-28 4.3 Medium
Authorization Bypass Through User-Controlled Key vulnerability in XWP Stream.This issue affects Stream: from n/a through 3.9.2.
CVE-2026-41372 1 Openclaw 1 Openclaw 2026-04-28 5.8 Medium
OpenClaw before 2026.4.2 fails to normalize trailing-dot localhost hosts in remote CDP discovery responses, allowing bypass of loopback protections. Attackers can craft hostile discovery responses returning localhost. to retarget authenticated browser control toward localhost endpoints and expose browser state.
CVE-2026-28747 1 Milesight 82 Ms-c2964-rflpc, Ms-c2966-rflwpc, Ms-c2966-x12rlpc and 79 more 2026-04-28 7.1 High
A weak key generation vulnerability exists in specific firmware versions of Milesight AIOT cameras allows authorization to be bypassed.
CVE-2026-6375 1 Spicejet 1 Online Booking System 2026-04-28 N/A
A vulnerability in SpiceJet’s booking API allows unauthenticated users to query passenger name records (PNRs) without any access controls. Because PNR identifiers follow a predictable pattern, an attacker could systematically enumerate valid records and obtain associated passenger names. This flaw stems from missing authorization checks on an endpoint intended for authenticated profile access.