CVE-2023-51489

CVE-2023-51489 is a CSRF vulnerability in the Crowdsignal Dashboard – Polls, Surveys & more by Automattic. The Red Hat advisory confirms the issue as Cross-Site Forgery in Crowdsignal Dashboard – Polls, Surveys & more, affecting Crowdsignal Dashboard – Polls, Surveys & more: from n/a through 3.0....

CVE-2023-51489 WordPress Crowdsignal Polls & Ratings plugin <= 3.0.11 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Automattic, Inc. Crowdsignal Dashboard – Polls, Surveys & more.This issue affects Crowdsignal Dashboard – Polls, Surveys & more: from n/a through 3.0.11...

BIT-MONGOOSE-2022-2564 Prototype Pollution in automattic/mongoose

Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6...

BIT-MONGOOSE-2023-3696 Prototype Pollution in automattic/mongoose

Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4...

Automattic: DOM XSS on multiple Automattic domains through postMessages

A DOM XSS vulnerability was found on widgets.wp.com allowing injection of scripts into the DOM. This was combined with a vulnerability in the Jetpack WordPress plugin where postMessages from widgets.wp.com were used to populate avatar URLs without validation, leading to DOM XSS on WordPress sites...

CVE-2023-50875

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Automattic Sensei LMS – Online Courses, Quizzes, & Learning allows Stored XSS.This issue affects Sensei LMS – Online Courses, Quizzes, & Learning: from n/a through 4.17.0...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Automattic Sensei LMS – Online Courses, Quizzes, & Learning allows Stored XSS.This issue affects Sensei LMS – Online Courses, Quizzes, & Learning: from n/a through 4.17.0...

CVE-2023-50875

CVE-2023-50875 affects the WordPress Sensei LMS plugin (versions

CVE-2023-50875 WordPress Sensei LMS Plugin <= 4.17.0 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Automattic Sensei LMS – Online Courses, Quizzes, & Learning allows Stored XSS.This issue affects Sensei LMS – Online Courses, Quizzes, & Learning: from n/a through 4.17.0...

CVE-2023-51488

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Automattic, Inc. Crowdsignal Dashboard – Polls, Surveys & more allows Reflected XSS.This issue affects Crowdsignal Dashboard – Polls, Surveys & more: from n/a through 3.0.11...

CVE-2023-51488

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Automattic, Inc. Crowdsignal Dashboard – Polls, Surveys & more allows Reflected XSS.This issue affects Crowdsignal Dashboard – Polls, Surveys & more: from n/a through 3.0.11...

CVE-2023-51488

CVE-2023-51488 affects the WordPress Crowdsignal Dashboard – Polls, Surveys & more plugin

CVE-2023-52222

Cross-Site Request Forgery CSRF vulnerability in Automattic WooCommerce.This issue affects WooCommerce: from n/a through 8.2.2...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Automattic WooCommerce.This issue affects WooCommerce: from n/a through 8.2.2...

CVE-2023-52222 WordPress WooCommerce Plugin <= 8.2.2 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Automattic WooCommerce.This issue affects WooCommerce: from n/a through 8.2.2...

CVE-2023-52222

CVE-2023-52222 affects the WordPress WooCommerce Plugin, listing vulnerable versions up to 8.2.2. The issue is a Cross-Site Request Forgery (CSRF) vulnerability with unauthenticated exploitation. Patchstack documents the fixed version as 8.3.0; remediation is to upgrade to 8.3.0 or later. The CVS...

CVE-2023-52222 WordPress WooCommerce Plugin <= 8.2.2 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Automattic WooCommerce.This issue affects WooCommerce: from n/a through 8.2.2...

CVE-2023-51503

Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 6.9.2...

CVE-2023-51503

Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 6.9.2...

Authorization

Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 6.9.2...