CVE-2024-9709 EKC Tournament Manager < 2.2.2 - Create Tournaments/Teams via CSRF

The EKC Tournament Manager WordPress plugin before 2.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-9711

The EKC Tournament Manager WordPress plugin is vulnerable to a Cross-Site Request Forgery (CSRF) attack in versions prior to 2.2.2 . The root cause is a lack of CSRF checks when updating plugin settings, which could allow an attacker to trick a logged-in administrator into making unauthorized cha...

CVE-2024-9711 EKC Tournament Manager < 2.2.2 - Delete Tournaments via CSRF

The EKC Tournament Manager WordPress plugin before 2.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-9709 EKC Tournament Manager < 2.2.2 - Create Tournaments/Teams via CSRF

The EKC Tournament Manager WordPress plugin before 2.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-9709

The EKC Tournament Manager WordPress plugin, in versions prior to 2.2.2 , is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The root cause is a lack of CSRF checks when updating plugin settings. This flaw could allow an attacker to force a logged-in administrator to modify these settin...

CVE-2024-9709 EKC Tournament Manager < 2.2.2 - Create Tournaments/Teams via CSRF

The EKC Tournament Manager WordPress plugin before 2.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-9450

The Free Booking Plugin for Hotels, Restaurants and Car Rentals WordPress plugin (also identified as eaSYNC ) versions prior to 1.3.15 is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The root cause is a lack of CSRF checks when updating plugin settings, which could allow an attacker ...

CVE-2024-9233 GS Logo Slider < 3.7.1 - Settings Update via Cross-Site Request Forgery

The Logo Slider WordPress plugin before 3.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-8398 Simple Nav Archives <= 2.1.3 - Settings Update via CSRF

The Simple Nav Archives WordPress plugin through 2.1.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-8398 Simple Nav Archives <= 2.1.3 - Settings Update via CSRF

The Simple Nav Archives WordPress plugin through 2.1.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-8286

The webtoffee-gdpr-cookie-consent WordPress plugin, in versions prior to 2.6.1 , is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The root cause is a lack of CSRF checks in certain bulk actions, which could allow an attacker to trick a logged-in administrator into performing unwanted ...

CVE-2024-8286 GDPR Cookie Consent <= 2.6.0 - Bulk Delete via CSRF

The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting visit logs via CSRF attacks...

CVE-2024-8245

The GamiPress WordPress plugin, specifically the GamiPress - Reset User component, is vulnerable to a Cross-Site Request Forgery (CSRF) attack in versions prior to 1.0.1 . The root cause is a missing CSRF check during the settings update process. An attacker could potentially trick a logged-in ad...

CVE-2024-8245 GamiPress - Reset User <= 1.0.0 - GamiPress User Data Removal via CSRF

The GamiPress WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-8095

CVE-2024-8095 concerns the BabelZ WordPress plugin (versions up to 1.1.5). Multiple sources confirm a lack of CSRF protection in certain areas, plus insufficient sanitisation and escaping, enabling a logged-in admin to inject a Stored XSS payload via a CSRF attack. The vulnerability affects BabelZ

CVE-2024-8094 Ntz Antispam <= 2.0e - Settings Update via CSRF

The Ntz Antispam WordPress plugin through 2.0e does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-8085

The PeoplePond WordPress plugin (versions 1.1.9 and earlier ) is vulnerable to a Cross-Site Request Forgery (CSRF) attack due to a lack of CSRF checks in certain areas combined with missing sanitization and escaping. This vulnerability could allow an attacker to force a logged-in administrator to...

CVE-2024-8090 JavaScript Logic <= 0.1 - CSRF to Stored XSS

The JavaScript Logic WordPress plugin through 0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-8094 Ntz Antispam <= 2.0e - Settings Update via CSRF

The Ntz Antispam WordPress plugin through 2.0e does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-8090 JavaScript Logic <= 0.1 - CSRF to Stored XSS

The JavaScript Logic WordPress plugin through 0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...