Woody Ad Snippets < 2.2.6 - Arbitrary Post Deletion

The adminInit function of the admin/includes/class.actions.snippets.php file, registered as an admininit hook did not have any CSRF or capability checks for its close action, allowing unauthenticated users to delete arbitrary posts from the blog PoC...

Pricing Table < 2.3 - Cross-Site Request Forgery

Lack of CSRF checks could allow attackers to make logged in users perform unwanted actions, such as arpliteimportexport...

File Manager < 5.2 - Multiple Vulnerabilities

Multiple vulnerabilities exist due to not checking the authentication of the user properly in the wpajax action calls. This results in SQL injection, backup download, backup deletion and backup restoration in the backup feature of the plugin. Authentication is required, but this can be of any use...

Dropshix <= 4.0.11 - Arbitrary Product Import

Due to lack of authorisation and CSRF checks in the AJAX function xoxImportItem...

FreeBSD : Jupyter notebook -- cross-site inclusion (XSSI) vulnerability (72a6e3be-483a-11e9-92d7-f1590402501e)

Jupyter notebook Changelog : 5.7.6 contains a security fix for a cross-site inclusion XSSI vulnerability, where files at a known URL could be included in a page from an unauthorized website if the user is logged into a Jupyter server. The fix involves setting the X-Content-Type-Options: nosniff...

GHSA-WPQ7-Q8J4-72JG Auth0-js bypasses CSRF checks

The Auth0.js library has a vulnerability affecting versions below 9.3 that allows an attacker to bypass the CSRF check from the state parameter if it's missing from the authorization response, leaving the client vulnerable to CSRF attacks...