CVE-2024-7984

The CVE concerns the WordPress plugin Joy Of Text Lite (SMS messaging for WordPress) versions 2.3.1 and earlier. The vulnerability arises from a missing CSRF check when updating plugin settings, which could allow an attacker to cause a logged-in admin to change settings via CSRF. Exploitation det...

CVE-2024-6719 Offload Videos – Bunny.net, AWS S3 <= 1.0.1 Subscriber+ CSRF

The Offload Videos WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could allow low privilege users to update them via a CSRF attack...

CVE-2024-6712 MapFig Studio <= 0.2.1 - Stored XSS via CSRF

The MapFig Studio WordPress plugin through 0.2.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-6719

The CVE-2024-6719 entry concerns the WordPress plugin “Offload Videos” (bunny.net/AWS S3 integration) prior to version 1.0.1. According to the documentation, the vulnerability arises from a missing CSRF check when updating plugin settings, which could allow low-privilege users to alter settings v...

CVE-2024-6712 MapFig Studio <= 0.2.1 - Stored XSS via CSRF

The MapFig Studio WordPress plugin through 0.2.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-6719 Offload Videos – Bunny.net, AWS S3 <= 1.0.1 Subscriber+ CSRF

The Offload Videos WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could allow low privilege users to update them via a CSRF attack...

CVE-2024-6712

The CVE-2024-6712 entry concerns the WordPress MapFig Studio plugin (versions ≤ 0.2.1). The root cause is missing CSRF checks in several areas, coupled with insufficient sanitisation and escaping, which could allow a logged-in admin to add stored XSS payloads via a CSRF attack. The vulnerability ...

CVE-2024-12750 Competition Form <= 2.0 - Competition Deletion via CSRF

The Competition Form WordPress plugin through 2.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-12750

CVE-2024-12750 concerns the WordPress plugin Competition Form (versions

CVE-2024-12750 Competition Form <= 2.0 - Competition Deletion via CSRF

The Competition Form WordPress plugin through 2.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-12301 JSP Store Locator <= 1.0 - Deletion via Missing CSRF

The JSP Store Locator WordPress plugin through 1.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

CVE-2024-12282 WordPress连接微博 <= 2.5.6 - Stored XSS via CSRF

The WordPress连接微博 WordPress plugin through 2.5.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-12282

CVE-2024-12282 concerns the WordPress连接微博 plugin (wp-connect) up to version 2.5.6. The issue is lack of CSRF protection in multiple locations, plus insufficient sanitisation/escaping, enabling a logged-in admin to store XSS payloads via CSRF. Impact per sources is stored Cross-Site Scripting affe...

CVE-2024-12301 JSP Store Locator <= 1.0 - Deletion via Missing CSRF

The JSP Store Locator WordPress plugin through 1.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

CVE-2024-11719 tarteaucitron.js for WordPress < 0.3.0 - Stored XSS via CSRF

The tarteaucitron-wp WordPress plugin before 0.3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-11719

The CVE-2024-11719 entry concerns the tarteaucitron-wp WordPress plugin prior to version 0.3.0, which lacks CSRF checks in certain areas and omits sanitisation and escaping. This could allow a logged-in attacker to trigger a Stored XSS payload via a CSRF attack. The issue is documented across mul...

CVE-2024-11719 tarteaucitron.js for WordPress < 0.3.0 - Stored XSS via CSRF

The tarteaucitron-wp WordPress plugin before 0.3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-11373

The Connexion Logs WordPress plugin (versions

CVE-2024-11373 Connexion Logs <= 3.0.2 - Log Deletion via CSRF

The Connexion Logs WordPress plugin through 3.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-11373 Connexion Logs <= 3.0.2 - Log Deletion via CSRF

The Connexion Logs WordPress plugin through 3.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...