CVE-2022-34347

Cross-Site Request Forgery CSRF vulnerability in W3 Eden Download Manager plugin = 3.2.48 at WordPress...

CVE-2022-2275

The WP Edit Menu WordPress plugin before 1.5.0 does not have CSRF in an AJAX action, which could allow attackers to make a logged in admin delete arbitrary posts/pages from the blog via a CSRF attack...

CVE-2022-2389

The Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami WordPress plugin before 2.1.2 does not have authorisation and CSRF checks in one of its AJAX action, allowing any authenticated users, such as subscriber to create automations...

CVE-2022-2275

The WP Edit Menu WordPress plugin before 1.5.0 does not have CSRF in an AJAX action, which could allow attackers to make a logged in admin delete arbitrary posts/pages from the blog via a CSRF attack...

CVE-2022-2276

The WP Edit Menu WordPress plugin before 1.5.0 does not have authorisation and CSRF in an AJAX action, which could allow unauthenticated attackers to delete arbitrary posts/pages from the blog...

CVE-2022-2389

The Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami WordPress plugin before 2.1.2 does not have authorisation and CSRF checks in one of its AJAX action, allowing any authenticated users, such as subscriber to create automations...

CVE-2022-2377

The Directorist WordPress plugin before 7.3.0 does not have authorisation and CSRF checks in an AJAX action, allowing any authenticated users to send arbitrary emails on behalf of the blog...

CVE-2021-36852

Cross-Site Request Forgery CSRF vulnerability in ThimPress WP Hotel Booking plugin = 1.10.5 at WordPress...

Cross site request forgery (csrf)

The WP Edit Menu WordPress plugin before 1.5.0 does not have CSRF in an AJAX action, which could allow attackers to make a logged in admin delete arbitrary posts/pages from the blog via a CSRF attack...

Cross site request forgery (csrf)

The Product Slider for WooCommerce WordPress plugin before 2.5.7 has flawed CSRF checks and lack authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber to call them. One in particular could allow them to delete arbitrary blog options...

CVE-2022-2377 Directorist < 7.3.0 - Subscriber+ Arbitrary E-mail Sending

The Directorist WordPress plugin before 7.3.0 does not have authorisation and CSRF checks in an AJAX action, allowing any authenticated users to send arbitrary emails on behalf of the blog...

CVE-2021-36852 WordPress WP Hotel Booking plugin <= 1.10.5 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in ThimPress WP Hotel Booking plugin = 1.10.5 at WordPress...

Pegasystem PEGA Platform 跨站请求伪造漏洞

Pegasystem PEGA Platform is a suite of application development platforms from Pegasystem UK. The platform is used to develop applications such as BPM Business Process Management, Case Management, Real-Time Decision Making and CRM Customer Relationship Management.A cross-site request forgery...

PT-2022-16307 · WordPress · Wp Coder

Name of the Vulnerable Software and Affected Versions: WP Coder WordPress plugin versions prior to 2.5.3 Description: The issue is related to the lack of a CSRF check when deleting code created by the plugin. This could allow attackers to make a logged-in admin delete arbitrary code via a CSRF...

WP Hotel Booking < 2.0.1 - Unauthenticated Arbitrary Settings Update

The plugin does not have authorisation and CSRF checks in place when updating its settings, which could allow unauthenticated attackers to change them. PoC All settings are affected, example, to change the Thousands Separator one, run the below command in the developer console of the web browser...

CVE-2022-36577

An issue was discovered in jizhicms v2.3.1. There is a CSRF vulnerability that can add a admin...

Design/Logic Flaw

An issue was discovered in jizhicms v2.3.1. There is a CSRF vulnerability that can add a admin...

CVE-2022-36225

EyouCMS V1.5.8-UTF8-SP1 is vulnerable to Cross Site Request Forgery CSRF via the background, column management function and add...

PT-2022-23266 · Xunruicms · Xunruicms

Name of the Vulnerable Software and Affected Versions: XunRuiCMS version 4.5.6 Description: The issue is related to Cross Site Request Forgery CSRF, which is a type of attack that tricks a user into performing unintended actions on a web application. Recommendations: For XunRuiCMS version 4.5.6,...

PT-2022-23267 · Eyoucms · Eyoucms

Name of the Vulnerable Software and Affected Versions: EyouCMS version 1.5.8-UTF8-SP1 Description: The issue concerns a Cross Site Request Forgery CSRF vulnerability. It affects the background, column management function, and add functionality. Recommendations: For EyouCMS version 1.5.8-UTF8-SP1,...