CVE-2025-3867 Ajax Comment Form CST <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Ajax Comment Form CST plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing or incorrect nonce validation via the 'acformcstsettings' page. This makes it possible for unauthenticated attackers to update settings and...

CVE-2025-3867: Improper Neutralization of Input During Web Page Generation

The Ajax Comment Form CST plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing or incorrect nonce validation via the 'acformcstsettings' page. This makes it possible for unauthenticated attackers to update settings and...

PT-2025-17889 · WordPress · Ajax Comment Form Cst

Name of the Vulnerable Software and Affected Versions: Ajax Comment Form CST plugin for WordPress versions up to, and including, 1.2 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation via the 'acform cst settings' page. This allows...

WordPress plugin Ajax Comment Form CST 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerabili...

WordPress Ajax Comment Form CST plugin <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability

Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability discovered by johska in WordPress Plugin Ajax Comment Form CST versions = 1.2...

WordPress wProject theme < 5.8.0 - Unauthenticated Post/Comment/Attachment Modification/Deletion vulnerability

Unauthenticated Post/Comment/Attachment Modification/Deletion vulnerability discovered by Dave Jong Patchstack in WordPress Theme wProject versions 5.8.0...

CVE-2025-30357

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, if a malicious user is leaving spam comments on many topics then an administrator, unable to manually remove each spam comment, may delete the malicious account. Once an administrator...

CVE-2025-30357: Use of Incorrectly-Resolved Name or Reference

NamelessMC is a free, easy to use & powerful website software for Minecraft servers. In version 2.1.4 and prior, if a malicious user is leaving spam comments on many topics then an administrator, unable to manually remove each spam comment, may delete the malicious account. Once an administrator...

Exploit for CVE-2025-29275

CVE-2025-29275 Proof of Concept PoC: In the Services tab, un...

CVE-2025-31026

Cross-Site Request Forgery CSRF vulnerability in Austin Comment Validation Reloaded comment-validation-reloaded allows Stored XSS.This issue affects Comment Validation Reloaded: from n/a through = 0.5...

CVE-2025-31026

Cross-Site Request Forgery CSRF vulnerability in Austin Comment Validation Reloaded comment-validation-reloaded allows Stored XSS.This issue affects Comment Validation Reloaded: from n/a through = 0.5...

CVE-2025-31026 WordPress Comment Validation Reloaded plugin <= 0.5 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Austin Comment Validation Reloaded comment-validation-reloaded allows Stored XSS.This issue affects Comment Validation Reloaded: from n/a through = 0.5...

CVE-2025-31026 WordPress Comment Validation Reloaded plugin <= 0.5 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Austin Comment Validation Reloaded comment-validation-reloaded allows Stored XSS.This issue affects Comment Validation Reloaded: from n/a through = 0.5...

CVE-2025-31026

CVE-2025-31026 is a CSRF-to-Stored XSS issue in the WordPress plugin Comment Validation Reloaded. The vulnerability affects Comment Validation Reloaded versions up to 0.5 (n/a through 0.5). The provided metrics cite CVSS 3.1 base score 7.1 (HIGH) with NETWORK attack vector, LOW confidentiality/in...

CVE-2024-46494

A cross-site scripting XSS vulnerability in Typecho v1.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into Name parameter under a comment for an Article...

CVE-2025-31026: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Austin Comment Validation Reloaded comment-validation-reloaded allows Stored XSS.This issue affects Comment Validation Reloaded: from n/a through = 0.5...

WordPress plugin Comment Validation Reloaded 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site request forgery...

CVE-2024-46494

A cross-site scripting XSS vulnerability in Typecho v1.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into Name parameter under a comment for an Article...

CVE-2024-46494

A cross-site scripting XSS vulnerability in Typecho v1.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into Name parameter under a comment for an Article...

CVE-2024-46494

Typecho v1.2.1 is vulnerable to a cross-site scripting (XSS) vulnerability. Attackers can execute arbitrary web scripts or HTML by injecting a crafted payload into the Name parameter when submitting a comment for an Article. As a temporary workaround, it is recommended to restrict access to the N...