CVE-2023-1925

The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation on the wpfcclearcacheofallsitescallback function. This makes it possible for unauthenticated attackers to clear cache...

CVE-2025-32972 The lesscss script service allows cache clearing without programming right

XWiki is a generic wiki platform. In versions starting from 6.1-milestone-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.8.0-rc-1, the script API of the LESS compiler in XWiki is incorrectly checking for rights when calling the cache cleaning API, makin...

CVE-2025-32972 The lesscss script service allows cache clearing without programming right

XWiki is a generic wiki platform. In versions starting from 6.1-milestone-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.8.0-rc-1, the script API of the LESS compiler in XWiki is incorrectly checking for rights when calling the cache cleaning API, makin...

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization through the lesscss script service. An attacker can cause a slowdown in XWiki execution by triggering unnecessary cache clearing operations. Remediation Upgrade org.xwiki.platform:xwiki-platform-lesscss-script to...

The lesscss script service allows cache clearing without programming right

Impact The script API of the LESS compiler in XWiki is incorrectly checking for rights when calling the cache cleaning API, making it possible to clean the cache without having programming right. The only impact of this is a slowdown in XWiki execution as the caches are re-filled. As this...

CVE-2024-13338 Webcraftic Clearfy – WordPress optimization plugin <= 2.3.1 - Cross-Site Request Forgery to Clear Cache

The Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.1. This is due to missing or incorrect nonce validation on the wclearfycachedelete functionality . This makes ...

CVE-2024-13338

CVE-2024-13338 concerns the Clearfy Cache WordPress plugin (versions

CVE-2025-2888

During a snapshot rollback, the client incorrectly caches the timestamp metadata. If the client checks the cache when attempting to perform the next update, the update timestamp validation will fail, preventing the next update until the cache is cleared. Users should upgrade to tough version 0.20...

CVE-2024-13438

The SpeedSize Image & Video AI-Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.1. This is due to missing or incorrect nonce validation on the 'speedsizeclearcsscacheaction' function. This makes it possible for unauthenticated...

CVE-2024-13438

The SpeedSize Image & Video AI-Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.1. This is due to missing or incorrect nonce validation on the 'speedsizeclearcsscacheaction' function. This makes it possible for unauthenticated...

CVE-2024-13438 SpeedSize Image & Video AI-Optimizer <= 1.5.1 - Cross-Site Request Forgery to Clear Cache

The SpeedSize Image & Video AI-Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.1. This is due to missing or incorrect nonce validation on the 'speedsizeclearcsscacheaction' function. This makes it possible for unauthenticated...

CVE-2024-13438

CVE-2024-13438 affects the SpeedSize Image & Video AI-Optimizer WordPress plugin (affected versions: ≤1.5.1). The issue is Cross-Site Request Forgery on speedsize_clear_css_cache_action, allowing unauthenticated attackers to clear the plugin cache by tricking a site administrator into performing ...

CVE-2024-13715

The zStore Manager Basic plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the zstoreclearcache function in all versions up to, and including, 3.311. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

CVE-2024-13715 zStore Manager Basic <= 3.311 - Missing Authorization to Authenticated (Subscriber+) Cache Clearing

The zStore Manager Basic plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the zstoreclearcache function in all versions up to, and including, 3.311. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

CVE-2024-13715

CVE-2024-13715 affects the WordPress plugin zStore Manager Basic (versions up to 3.311). Root cause: a missing capability check in the function zstore_clear_cache() . Impact: authenticated attackers with Subscriber+ privileges can clear the plugin cache, causing unauthorized data loss. Remediatio...

WordPress zStore Manager Basic plugin <= 3.311 - Missing Authorization to Authenticated (Subscriber+) Cache Clearing vulnerability

Missing Authorization to Authenticated Subscriber+ Cache Clearing vulnerability discovered by Peter Thaleikis in WordPress Plugin zStore Manager Basic versions = 3.311...

WordPress Simple Local Avatars plugin <= 2.7.11 - Missing Authorization to Authenticated (Subscriber+) User Cache Clearing vulnerability

Missing Authorization to Authenticated Subscriber+ User Cache Clearing vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Simple Local Avatars versions = 2.7.11...

CVE-2024-40927

In the Linux kernel, the following vulnerability has been resolved: xhci: Handle TD clearing for multiple streams case When multiple streams are in use, multiple TDs might be in flight when an endpoint is stopped. We need to issue a Set TR Dequeue Pointer for each, to ensure everything is reset...

Themify Builder < 7.0.6 - Cross-Site Request Forgery

Description The Themify Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 7.0.5. This is due to missing or incorrect nonce validation on the cachemenu function. This makes it possible for unauthenticated attackers to clear cache via a forge...

CVE-2023-1925

The WP Fastest Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation on the wpfcclearcacheofallsitescallback function. This makes it possible for unauthenticated attackers to clear cache...