Unauthorised AJAX Calls via Freemius

Description The plugins and themes use an insecure version of the Freemius Framework, which is lacking CSRF and/or authorisation in some of its AJAX actions. As a result, any authenticated users, such as subscriber could access the debug logs. Unauthenticated attackers could also make a logged in...

WordPress HM Testimonial – Best Testimonial Plugin for WordPress plugin <= 1.3 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress HM Testimonial – Best Testimonial Plugin for WordPress plugin versions = 1.3. Solution Update the WordPress HM Testimonial – Best Testimonial Plugin for WordPress plugin to the latest available version...

WordPress Ultra Elementor Addons plugin <= 1.0.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Ultra Elementor Addons plugin versions = 1.0.0. Solution No patched version available...

WordPress Advanced Exchange Rates for WooCommerce Multilingual plugin <= 1.0.6 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Advanced Exchange Rates for WooCommerce Multilingual plugin versions = 1.0.6. Solution No patched version available...

WordPress Print My Blog plugin < 3.11.4 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Print My Blog plugin versions 3.11.4. Solution Update the WordPress Print My Blog plugin to the latest available version at least 3.11.4...

WordPress Automatic YouTube Gallery plugin < 1.6.5 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Automatic YouTube Gallery plugin versions 1.6.5. Solution Update the WordPress Automatic YouTube Gallery plugin to the latest available version at least 1.6.5...

WordPress Video Player for YouTube plugin <= 1.4.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Video Player for YouTube plugin versions = 1.4.2. Solution Update the WordPress Video Player for YouTube plugin to the latest available version at least 1.5.1...

WordPress WP Data Access plugin < 5.1.4 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress WP Data Access plugin versions 5.1.4. Solution Update the WordPress WP Data Access plugin to the latest available version at least 5.1.4...

WordPress SV Forms plugin < 1.8.10 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress SV Forms plugin versions 1.8.10. Solution Update the WordPress SV Forms plugin to the latest available version at least 1.8.10...

WordPress Modern Addons for Elementor Page Builder plugin <= 1.1.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Modern Addons for Elementor Page Builder plugin versions = 1.1.2. Solution Update the WordPress Modern Addons for Elementor Page Builder plugin to the latest available version at least 1.2.0...

WordPress Italian VAT Kit for WooCommerce plugin < 1.3.23 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Italian VAT Kit for WooCommerce plugin versions 1.3.23. Solution Update the WordPress Italian VAT Kit for WooCommerce plugin to the latest available version at least 1.3.23...

WordPress All in One Invite Codes plugin <= 1.0.12 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress All in One Invite Codes plugin versions = 1.0.12. Solution Update the WordPress All in One Invite Codes plugin to the latest available version at least 1.0.13...

WordPress Easy Responsive Pricing Tables plugin <= 1.1.3 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Easy Responsive Pricing Tables plugin versions = 1.1.3. Solution No patched version available...

WordPress Display Eventbrite Events plugin < 4.4.8 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Display Eventbrite Events plugin versions 4.4.8. Solution Update the WordPress Display Eventbrite Events plugin to the latest available version at least 4.4.8...

WordPress RecurWP – WordPress Recurly Payment Gateway plugin <= 1.0.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress RecurWP – WordPress Recurly Payment Gateway plugin versions = 1.0.1. Solution No patched version available...

WordPress Slider Plugin – Block Slider plugin <= 1.2.9 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Slider Plugin – Block Slider plugin versions = 1.2.9. Solution Update the WordPress Slider Plugin – Block Slider plugin to the latest available version at least 2.0.0...

WordPress Turbo Widgets plugin <= 2.0.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Turbo Widgets plugin versions = 2.0.0. Solution No patched version available...

WordPress WordPress Team Members – GS Plugins plugin <= 1.10.18 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress WordPress Team Members – GS Plugins plugin versions = 1.10.18. Solution Update the WordPress WordPress Team Members – GS Plugins plugin to the latest available version at least 1.11.0...

WordPress Livemesh Addons for WPBakery Page Builder plugin <= 2.9.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Livemesh Addons for WPBakery Page Builder plugin versions = 2.9.1. Solution Update the WordPress Livemesh Addons for WPBakery Page Builder plugin to the latest available version at least 2.9.2...

WordPress WP Notification Bell plugin < 1.3.13 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress WP Notification Bell plugin versions 1.3.13. Solution Update the WordPress WP Notification Bell plugin to the latest available version at least 1.3.13...