WordPress Anant Addons for Elementor plugin <= 1.1.8 - CSRF to Arbitrary Plugin Installation vulnerability

CSRF to Arbitrary Plugin Installation vulnerability discovered by stealthcopter in WordPress Plugin Anant Addons for Elementor versions = 1.1.8...

CVE-2024-6857

The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating its Header, Footer and Body Script Settings, which could allow attackers to make logged admins perform such action via a CSRF attack...

CVE-2024-8243 Plugin Upgrade Time Out <= 1.0 - Stored XSS via CSRF

The WordPress/Plugin Upgrade Time Out Plugin WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-8243

The WordPress/Plugin Upgrade Time Out Plugin (versions through 1.0 ) is vulnerable to a Stored XSS attack via Cross-Site Request Forgery (CSRF) . The root cause is a lack of CSRF checks in certain areas, combined with insufficient sanitization and escaping . This allows an attacker to trick a log...

CVE-2024-8243 Plugin Upgrade Time Out <= 1.0 - Stored XSS via CSRF

The WordPress/Plugin Upgrade Time Out Plugin WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-6860 WP MultiTasking <= 0.1.12 - Permalink Suffix Update via CSRF

The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating its permalink suffix settings, which could allow attackers to make logged admins perform such action via a CSRF attack...

CVE-2024-6860

The WP MultiTasking WordPress plugin (versions 0.1.12 and earlier ) is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The flaw exists because the plugin fails to implement proper CSRF checks when updating its permalink suffix settings . An attacker could potentially trick a logged-in a...

CVE-2024-6857 WP MultiTasking <= 0.1.12 - Header/Footer/Body Script Update via CSRF

The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating its Header, Footer and Body Script Settings, which could allow attackers to make logged admins perform such action via a CSRF attack...

CVE-2024-6857 WP MultiTasking <= 0.1.12 - Header/Footer/Body Script Update via CSRF

The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating its Header, Footer and Body Script Settings, which could allow attackers to make logged admins perform such action via a CSRF attack...

PT-2025-15744 · Unknown · Bdoga Social Crowd

Name of the Vulnerable Software and Affected Versions: bdoga Social Crowd versions 0.9.6.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. Recommendations: For versions 0.9.6.1 and earlier, update to a version that contains a fix for...

PT-2025-15800 · Foliopress · Foliopress Wysiwyg

Name of the Vulnerable Software and Affected Versions: Foliopress WYSIWYG versions n/a through 2.6.18 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows unauthorized actions to be performed on a user's account without their knowledge or consent. This is due to...

PT-2025-15806 · Unknown · Plaininventory

Name of the Vulnerable Software and Affected Versions: PlainInventory versions n/a through 3.1.9 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on the web application,...

PT-2025-15723 · Unknown · Uzair Easyfonts

Name of the Vulnerable Software and Affected Versions: Uzair Easyfonts versions 1.1.2 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. Recommendations: For versions 1.1.2 and earlie...

PT-2025-15810 · Unknown · Vite Coupon

Name of the Vulnerable Software and Affected Versions: Vite Coupon versions 1.0.7 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Remote Code Inclusion. This means an attacker can potentially execute malicious code on a remote server, which could...

PT-2025-15786 · WordPress · Push Notification For Wp

Name of the Vulnerable Software and Affected Versions: All push notification for WP versions 1.5.3 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that also allows Blind SQL Injection. This means an attacker could potentially force a user to perfor...

PT-2025-15805 · WordPress · Vsourz Digital Wp Map Route Planner

Name of the Vulnerable Software and Affected Versions: Vsourz Digital WP Map Route Planner versions 1.0.0 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. Recommendations: For Vsourz Digital WP Map Route Planner versio...

PT-2025-15816 · Unknown · Doppler Forms

Name of the Vulnerable Software and Affected Versions: Doppler Forms versions 2.4.5 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application,...

PT-2025-15754 · Unknown · Af Tell A Friend

Name of the Vulnerable Software and Affected Versions: AF Tell a Friend versions 1.4 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application,...

PT-2025-15673 · WordPress · Wp Multitasking

Name of the Vulnerable Software and Affected Versions: WP MultiTasking WordPress plugin versions 0.1.12 and earlier Description: The WP MultiTasking WordPress plugin does not have a CSRF check when updating its permalink suffix settings, which could allow attackers to make logged-in administrator...

PT-2025-15794 · Unknown · Agence Web Eoxia - Montpellier Wp Shop

Name of the Vulnerable Software and Affected Versions: Agence web Eoxia - Montpellier WP shop versions n/a through 2.6.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows an attacker to upload a web shell to a web server. This can be achieved through exploiting...