CVE-2024-10634

The Nokaut Offers Box WordPress plugin (versions 1.4.0 and earlier ) is vulnerable to a Cross-Site Request Forgery (CSRF) attack due to a lack of CSRF checks when updating plugin settings. An attacker could leverage this vulnerability to force a logged-in administrator to reset the plugin. To mit...

CVE-2024-10634 Nokaut Offers Box <= 1.4.0 - Plugin Reset via CSRF

The Nokaut Offers Box WordPress plugin through 1.4.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin reset the Nokaut Offers Box WordPress plugin through 1.4.0 via a CSRF attack...

CVE-2024-10677 BTEV <= 2.0.2 - Settings Update via CSRF

The BTEV WordPress plugin through 2.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-10677

The BTEV WordPress plugin (versions 2.0.2 and earlier ) is vulnerable to a Cross-Site Request Forgery (CSRF) attack due to a lack of CSRF checks when updating plugin settings. This flaw could allow an attacker to trick a logged-in administrator into making unauthorized changes to the plugin's con...

PT-2025-21540 · WordPress · Logo Slider

Name of the Vulnerable Software and Affected Versions: Logo Slider WordPress plugin versions prior to 3.7.1 Description: The issue concerns the lack of CSRF check when updating settings, which could allow attackers to make a logged-in administrator change them via a CSRF attack. This could...

PT-2025-21549 · WordPress · Ekc Tournament Manager

Name of the Vulnerable Software and Affected Versions: EKC Tournament Manager versions prior to 2.2.2 Description: The issue concerns the lack of a CSRF check when updating settings in the EKC Tournament Manager WordPress plugin. This could allow attackers to make a logged-in admin change the...

PT-2025-21543 · Unknown · Free Booking Plugin

Name of the Vulnerable Software and Affected Versions: Free Booking Plugin for Hotels, Restaurants and Car Rentals versions prior to 1.3.15 Description: The issue concerns the lack of CSRF check when updating settings, which could allow attackers to make a logged-in subscriber change them via a...

WordPress plugin WebToffee-GDPR-Cookie-Consent has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2025-21421 · WordPress · The Connexion Logs Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: The Connexion Logs WordPress plugin versions 3.0.2 and earlier Description: The issue is related to the lack of a CSRF check when updating settings in the plugin, which could allow attackers to make a logged-in admin change them via a CSRF...

PT-2025-21548 · WordPress · Ekc Tournament Manager

Name of the Vulnerable Software and Affected Versions: EKC Tournament Manager WordPress plugin versions prior to 2.2.2 Description: The issue is related to the lack of a CSRF check when updating settings in the EKC Tournament Manager WordPress plugin. This could allow attackers to make a logged-i...

PT-2025-21384 · WordPress · Illi Link Party!

Name of the Vulnerable Software and Affected Versions: The illi Link Party! WordPress plugin version 1.0 Description: The issue is related to the lack of a CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. Recommendations: For...

PT-2025-21407 · WordPress · Nokaut Offers Box

Name of the Vulnerable Software and Affected Versions: Nokaut Offers Box WordPress plugin versions 1.4.0 and earlier Description: The issue concerns the lack of CSRF check when updating settings in the Nokaut Offers Box WordPress plugin. This could allow attackers to make a logged-in admin reset...

PT-2025-21511 · WordPress · Peoplepond

Name of the Vulnerable Software and Affected Versions: PeoplePond WordPress plugin versions 1.1.9 and earlier Description: The issue concerns the lack of CSRF checks in certain areas and missing sanitization as well as escaping in the PeoplePond WordPress plugin. This could allow attackers to mak...

PT-2025-21441 · WordPress · Competition Form

Name of the Vulnerable Software and Affected Versions: The Competition Form WordPress plugin versions 2.0 and earlier Description: The issue is related to the lack of a CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack...

PT-2025-21371 · WordPress · Travelpayouts: All Travel Brands In One Place

Name of the Vulnerable Software and Affected Versions: The Travelpayouts: All Travel Brands in One Place WordPress plugin versions prior to 1.1.13 Description: The issue concerns a lack of CSRF check when importing settings from v1, which could allow attackers to make a logged-in admin update som...

PT-2025-21509 · WordPress · The Custom Author Base Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: The Custom Author Base WordPress plugin versions 1.1.1 and earlier Description: The issue is related to the lack of a CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack...

PT-2025-21424 · WordPress · Tarteaucitron-Wp

Name of the Vulnerable Software and Affected Versions: tarteaucitron-wp WordPress plugin versions prior to 0.3.0 Description: The issue concerns a lack of CSRF check in some areas and missing sanitization as well as escaping. This could allow attackers to make logged-in admins add Stored XSS...

PT-2025-21382 · WordPress · The Marketing Twitter Bot Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: The Marketing Twitter Bot WordPress plugin versions 1.11 and earlier Description: The issue is related to the lack of CSRF check in some places, as well as missing sanitization and escaping, which could allow attackers to make logged-in admin...

PT-2025-21508 · WordPress · The Smooth Gallery Replacement

Name of the Vulnerable Software and Affected Versions: The Smooth Gallery Replacement WordPress plugin versions 1.0 and earlier Description: The issue is related to the lack of CSRF checks in some areas of the plugin, as well as missing sanitization and escaping. This could allow attackers to mak...

PT-2025-21514 · WordPress · Babelz

Name of the Vulnerable Software and Affected Versions: BabelZ WordPress plugin versions 1.1.5 and earlier Description: The issue concerns the lack of CSRF check and missing sanitization as well as escaping in certain areas of the plugin. This could allow attackers to make logged-in admins add...