CVE-2024-3476

The Side Menu Lite WordPress plugin before 4.2.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting buttons via CSRF attacks...

CVE-2024-3475

The Sticky Buttons WordPress plugin before 3.2.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting buttons via CSRF attacks...

CVE-2024-3476

The Side Menu Lite WordPress plugin before 4.2.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting buttons via CSRF attacks...

CVE-2024-2405

The Float menu WordPress plugin before 6.0.1 does not have CSRF check in its bulk actions, which could allow attackers to make logged in admin delete arbitrary menu via a CSRF attack...

CVE-2024-3476

The Side Menu Lite WordPress plugin versions prior to 4.2.1 are vulnerable to a Cross-Site Request Forgery (CSRF) attack due to a lack of CSRF checks in certain bulk actions. This security flaw could allow an attacker to trick a logged-in administrator into performing unintended actions, such as ...

CVE-2024-3477

The Popup Box WordPress plugin (versions prior to 2.2.7 ) is vulnerable to a Cross-Site Request Forgery (CSRF) attack due to a lack of CSRF checks in certain bulk actions. An attacker could trick a logged-in administrator into performing unwanted actions, such as deleting popups . To remediate th...

CVE-2024-3478

The Herd Effects WordPress plugin, in versions prior to 5.2.7 , is vulnerable to a Cross-Site Request Forgery (CSRF) flaw. The root cause is a lack of CSRF checks in certain bulk actions, which could allow a remote attacker to trick a logged-in administrator into performing unauthorized actions, ...

CVE-2024-3475

The Sticky Buttons WordPress plugin versions prior to 3.2.4 is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The root cause is a lack of CSRF checks in certain bulk actions , which could allow an attacker to trick a logged-in administrator into performing unwanted actions, such as del...

CVE-2024-2405 Float menu < 6.0.1 - Menu Deletion via CSRF

The Float menu WordPress plugin before 6.0.1 does not have CSRF check in its bulk actions, which could allow attackers to make logged in admin delete arbitrary menu via a CSRF attack...

CVE-2024-3474

CVE-2024-3474 concerns the WordPress plugin Wow Skype Buttons (versions before 4.0.4). The issue is a CSRF vulnerability in certain bulk actions that can let an authenticated, logged-in admin perform unauthorized operations, such as deleting buttons, via crafted requests. Public descriptions in R...

CVE-2024-3478: Cross-Site Request Forgery (CSRF)

The Herd Effects WordPress plugin before 5.2.7 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting effects via CSRF attacks...

CVE-2024-2405: Cross-Site Request Forgery (CSRF)

The Float menu WordPress plugin before 6.0.1 does not have CSRF check in its bulk actions, which could allow attackers to make logged in admin delete arbitrary menu via a CSRF attack...

CVE-2024-3474: Cross-Site Request Forgery (CSRF)

The Wow Skype Buttons WordPress plugin before 4.0.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting buttons via CSRF attacks...

CVE-2024-3475: Cross-Site Request Forgery (CSRF)

The Sticky Buttons WordPress plugin before 3.2.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting buttons via CSRF attacks...

CVE-2024-3481: Cross-Site Request Forgery (CSRF)

The Counter Box WordPress plugin before 1.2.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such deleting counters via CSRF attacks...

CVE-2024-3477: Cross-Site Request Forgery (CSRF)

The Popup Box WordPress plugin before 2.2.7 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting popups via CSRF attacks...

CVE-2024-3476: Cross-Site Request Forgery (CSRF)

The Side Menu Lite WordPress plugin before 4.2.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting buttons via CSRF attacks...

PT-2024-26499

Name of the Vulnerable Software and Affected Versions Software affected versions not specified Description The issue is related to the use of a reversible password encryption algorithm, which allows attackers to decrypt passwords. Sensitive information can be easily unencrypted by the attacker, a...

PT-2024-18025 · WordPress · Responsive Contact Form Builder & Lead Generation Plugin

Name of the Vulnerable Software and Affected Versions: The Responsive Contact Form Builder & Lead Generation Plugin plugin for WordPress versions up to, and including, 1.8.9 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on several...

PT-2024-28469 · Unknown · The Post Grid – Shortcode

Name of the Vulnerable Software and Affected Versions: The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid plugin versions up to, and including, 7.6.1 Description: The issue allows authenticated attackers with subscriber access or higher to modify the plugin's settings a...