Admin And Site Enhancements (Ase)
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:admin_and_site_enhancements_(ase):*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Admin And Site Enhancements (Ase) (0215b842-6161-50bf-8747-0218f5191ea0) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-12083 |
vulnerable | 2026-07-29 00:23:31.929031 |
Admin and Site Enhancements < 8.8.4 - Unauthenticated Administrator-Role Restoration via reset-for Parameter
The Admin and Site Enhancements (ASE) WordPress plugin before 8.8.4, admin-site-enhancements-pro WordPress plugin before 8.8.4 does not perform authentication, authorization, or nonce checks on a role-restoration request handler, allowing unauthenticated attackers to restore a previously demoted administrator account back to the administrator role. This is an incomplete fix of CVE-2024-43333 / CVE-2025-24648, which closed the issue for only one of the demotion paths the WordPress role API exposes.
Published: 2026-07-06T06:00:02.042Z
Updated: 2026-07-06T12:00:32.159Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-9487 |
vulnerable | 2026-06-08 07:45:22.571587 |
Admin and Site Enhancements < 7.9.8 - Authenticated Stored XSS via SVG
The Admin and Site Enhancements (ASE) WordPress plugin before 7.9.8 does not sanitise SVG files when uploaded via xmlrpc.php when such uploads are enabled, which could allow users to upload a malicious SVG containing XSS payloads
Published: 2025-09-22T06:00:14.172Z
Updated: 2025-09-22T16:10:43.154Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-13688 |
vulnerable | 2026-06-08 06:25:38.220888 |
Admin and Site Enhancements (ASE) < 7.6.10 - Password Protection Bypass
The Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10 uses a hardcoded password in its Password Protection feature, allowing attacker to bypass the protection offered via a crafted request
Published: 2025-04-28T06:00:01.714Z
Updated: 2025-08-27T12:00:43.055Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-13685 |
vulnerable | 2026-06-08 06:25:38.214097 |
Admin and Site Enhancements (ASE) < 7.6.10 - Limit Login Attempt Bypass via IP Spoofing
The Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate their value to bypass the login limit feature in the Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10.
Published: 2025-03-04T06:00:04.054Z
Updated: 2025-03-04T14:32:08.168Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.