WordPress Zajax – Ajax Navigation Plugin <= 0.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Zajax – Ajax Navigation Type Plugin Vulnerable versions = 0.4 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-53719 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 3d6723133578 Credits SOPROBRO Requir...

WordPress Hotlink2Watermark Plugin <= 0.3.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Hotlink2Watermark Type Plugin Vulnerable versions = 0.3.2 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-53711 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 076242f1338b Credits SOPROBRO Required...

WordPress Kevin's Plugin <= 2.0.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Kevin's Type Plugin Vulnerable versions = 2.0.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-53712 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 3dc43c4ca7f8 Credits SOPROBRO Required privilege...

WordPress wp auto top Plugin <= 2.9.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software wp auto top Type Plugin Vulnerable versions = 2.9.3 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-53716 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID c8913fda836f Credits SOPROBRO Required privile...

WordPress Ahmeti Wp Güzel Sözler Plugin <= 4.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Ahmeti Wp Güzel Sözler Type Plugin Vulnerable versions = 4.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-53707 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 29f434d8f692 Credits thiennv Required...

ProjectSend R1605 Unauthenticated Remote Code Execution

class MetasploitModule 'ProjectSend r1295 - r1605 Unauthenticated Remote Code Execution', 'Description' = %q This module exploits an improper authorization vulnerability in ProjectSend versions r1295 through r1605. The vulnerability allows an unauthenticated attacker to obtain remote code executi...

WordPress ITERAS Plugin <= 1.7.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software ITERAS Type Plugin Vulnerable versions = 1.7.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-53710 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID fe46f5e0e01b Credits SOPROBRO Required privilege...

WordPress Multi Feed Reader Plugin <=2.2.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Multi Feed Reader Type Plugin Vulnerable versions =2.2.4 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-53718 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID d3cb59a47389 Credits Joshua Chan Required...

WordPress yPHPlista Plugin <= 1.1.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software yPHPlista Type Plugin Vulnerable versions = 1.1.1 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-53717 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 7637319ee818 Credits SOPROBRO Required privilege...

WordPress Simple Travel Map Plugin <= 0.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Simple Travel Map Type Plugin Vulnerable versions = 0.1 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-53715 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID cb9374ea8217 Credits SOPROBRO Required...

WordPress Favicon My Blog Plugin <= 1.0.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Favicon My Blog Type Plugin Vulnerable versions = 1.0.2 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-53722 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 5a8d31e58ef6 Credits SOPROBRO Required...

WordPress IceStats Plugin <= 1.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software IceStats Type Plugin Vulnerable versions = 1.3 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-53724 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 228e60432718 Credits SOPROBRO Required privilege...

WordPress RealtyCandy IDX Broker Extended Plugin <= 1.5.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software RealtyCandy IDX Broker Extended Type Plugin Vulnerable versions = 1.5.1 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-53726 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 24b8b3d7db9b Credits...

WordPress Alphabetical List plugin <= 1.0.3 - Settings Update via CSRF vulnerability

Settings Update via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin Alphabetical List versions = 1.0.3...

CVE-2024-8157

The Alphabetical List WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-5029

The CM Table Of Contents WordPress plugin before 1.2.4 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-8157 Alphabetical List <= 1.0.3 - Settings Update via CSRF

The Alphabetical List WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-8157

The CVE-2024-8157 entry concerns the WordPress Alphabetical List plugin (versions up to 1.0.3). The vulnerability is a CSRF weakness in the settings update flow: there is no CSRF protection when updating settings, which could allow a logged-in administrator to modify settings via CSRF. Affected c...

CVE-2024-8157 Alphabetical List <= 1.0.3 - Settings Update via CSRF

The Alphabetical List WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-5029

The CM Table Of Contents WordPress plugin (versions before 1.2.4) is vulnerable due to missing CSRF protection when updating settings, and lack of input sanitisation/escaping. The issue could enable a logged-in administrator to inject Stored XSS payloads via a CSRF attack. Remediation: upgrade to...