plugin

Catch Web Tools Vulnerabilities

2 known security issues reported for the Catch Web Tools WordPress plugin. Most recent disclosed Jan 24, 2022.

2 medium

Running Catch Web Tools on your site? Check whether your installed version is affected.

Scan your site free

Catch Web Tools <= 2.7.0 - Missing Authorization

medium

The Catch Web Tools plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the catchwebtools_catchids_switch AJAX action in versions up to, and including, 2.7.0. This makes it possible for subscriber-level attackers to active or deactivate catch IDs.

CVSS:
5.4
Affected:
up to 2.7.0
Fixed in:
2.7.1
Disclosed:
Jan 24, 2022

CatchThemes Plugins (Various Versions) - Missing Authorization

medium

Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essential Widgets WordPress plugin before 1.9, To Top WordPress plugin before 2.3, Header Enhancement WordPress plugin before...

CVSS:
5.4
Affected:
up to 2.7
Fixed in:
2.7
Disclosed:
Sep 20, 2021

CVE-2021-24752 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database