Filtered by vendor Infinitumform Subscriptions
Total 2 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-7381 2 Infinitumform, Wordpress 2 Geo Controller, Geo Controller 2024-09-06 5.3 Medium
The Geo Controller plugin for WordPress is vulnerable to unauthorized shortcode execution due to missing authorization and capability checks on the ajax__shortcode_cache function in all versions up to, and including, 8.6.9. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes available on the target site.
CVE-2024-7380 1 Infinitumform 1 Geo Controller 2024-09-06 4.3 Medium
The Geo Controller plugin for WordPress is vulnerable to unauthorized menu creation/deletion due to missing capability checks on the ajax__geolocate_menu and ajax__geolocate_remove_menu functions in all versions up to, and including, 8.6.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create or delete WordPress menus.