WordPress plugin SMS for WooCommerce: Cross-site Request Forgery vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

PT-2024-17531 · WordPress · User Role Editor

Name of the Vulnerable Software and Affected Versions: User Role Editor plugin for WordPress versions up to, and including, 4.64.3 Description: The issue is due to missing or incorrect nonce validation on the update roles function, making it possible for unauthenticated attackers to add or remove...

PT-2024-17660

Name of the Vulnerable Software and Affected Versions Hello In All Languages plugin for WordPress versions up to, and including, 1.0.6 Description The issue is due to missing or incorrect nonce validation on a function, allowing unauthenticated attackers to update settings and inject malicious we...

PT-2024-16977

Name of the Vulnerable Software and Affected Versions Password for WP plugin for WordPress versions up to, and including, 1.3 Description The issue is due to missing or incorrect nonce validation on the get3 init admin page function, making it possible for unauthenticated attackers to update...

PT-2024-17398

Name of the Vulnerable Software and Affected Versions WPC Order Notes for WooCommerce plugin for WordPress versions up to, and including, 1.5.2 Description The issue is due to missing or incorrect nonce validation on the ajax update order note function, making it possible for unauthenticated...

CVE-2024-10832

The Posti Shipping plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the accountnumber and secretkey parameters in all versions up to, and including, 3.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

PT-2024-16577

Name of the Vulnerable Software and Affected Versions Posti Shipping plugin for WordPress versions up to, and including, 3.10.3 Description The issue is due to missing or incorrect nonce validation on the generate notices html function. This makes it possible for unauthenticated attackers to inje...

CVE-2024-10521 WordPress Contact Forms by Cimatti <= 1.9.2 - Cross-Site Request Forgery via process_bulk_action Function

The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.2. This is due to missing or incorrect nonce validation on the processbulkaction function. This makes it possible for unauthenticated attackers to dele...

CVE-2024-11342

The Skt NURCaptcha plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.5.0. This is due to missing or incorrect nonce validation in the skt-nurc-admin.php file. This makes it possible for unauthenticated attackers to update settings and inject...

PT-2024-16924 · WordPress · Skt Nurcaptcha

Name of the Vulnerable Software and Affected Versions: Skt NURCaptcha plugin for WordPress versions up to, and including, 3.5.0 Description: The issue is due to missing or incorrect nonce validation in the skt-nurc-admin.php file, making it possible for unauthenticated attackers to update setting...

CVE-2024-11601 Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) <= 2.6.1 - Cross-Site Request Forgery to Limited Arbitrary Options Update

The Sky Addons for Elementor Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blog, Video Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.1. This is due to missing or incorrect...

CVE-2024-9434

The WPGlobus Translate Options plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to missing or incorrect nonce validation on the ontranslateoptionspage function. This makes it possible for unauthenticated attackers to inject...

CVE-2024-9598

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.99.1. This is due to missing or incorrect nonce validation on the 'proxy' function. This makes it possible for unauthenticated attackers to send the...

CVE-2024-10045

CVE-2024-10045 affects the WordPress plugin Transients Manager (versions

CVE-2024-9592 Easy PayPal Gift Certificate <= 1.2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting via wpppgc_plugin_options

The Easy PayPal Gift Certificate plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.3. This is due to missing or incorrect nonce validation on the 'wpppgcpluginoptions' function. This makes it possible for unauthenticated attackers to update the...

PT-2024-39043 · Brevo · The Newsletter

Name of the Vulnerable Software and Affected Versions: The Newsletter, SMTP, Email marketing and Subscribe forms by Brevo plugin for WordPress versions up to, and including, 3.1.87 Description: The issue is due to missing or incorrect nonce validation on the Init function, making it possible for...

CVE-2024-8490

The PropertyHive plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.19. This is due to missing or incorrect nonce validation on the 'saveaccountdetails' function. This makes it possible for unauthenticated attackers to edit the name, email...

CVE-2024-8490 PropertyHive <= 2.0.19 - Cross-Site Request Forgery via save_account_details

The PropertyHive plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.19. This is due to missing or incorrect nonce validation on the 'saveaccountdetails' function. This makes it possible for unauthenticated attackers to edit the name, email...

PT-2024-39054

Name of the Vulnerable Software and Affected Versions: PropertyHive plugin for WordPress versions up to, and including, 2.0.19 Description: The issue is due to missing or incorrect nonce validation on the save account details function, making it possible for unauthenticated attackers to edit the...

CVE-2024-8319 Tourfic <= 2.11.20 - Cross-Site Request Forgery in Multiple Functions

The Tourfic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.11.20. This is due to missing or incorrect nonce validation on the tforderstatusemailresendfunction, tfvisitordetailseditfunction, tfcheckinoutdetailseditfunction,...