CVE-2021-4411 WP EasyPay – Square for WordPress <= 3.2.0 - Cross-Site Request Forgery Bypass

The WP EasyPay – Square for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.0. This is due to missing or incorrect nonce validation on the wpepdownloadtransactioninexcel function. This makes it possible for unauthenticated attackers...

PT-2023-11890

Name of the Vulnerable Software and Affected Versions EWWW Image Optimizer plugin for WordPress versions up to, and including, 5.8.1 Description The issue is due to missing or incorrect nonce validation on the ewww ngg bulk init function, making it possible for unauthenticated attackers to perfor...

PT-2023-12534

Name of the Vulnerable Software and Affected Versions Sell Media plugin for WordPress versions up to, and including, 2.5.5 Description The issue is due to missing or incorrect nonce validation on the sell media process function, making it possible for unauthenticated attackers to sell media paypa...

CVE-2020-36749

The Easy Testimonials plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.6.1. This is due to missing or incorrect nonce validation on the saveCustomFields function. This makes it possible for unauthenticated attackers to save custom fields via a...

CVE-2020-36747

The Lightweight Sidebar Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.4. This is due to missing or incorrect nonce validation on the metaboxsave function. This makes it possible for unauthenticated attackers to save metbox data via ...

CVE-2021-4398

The Amministrazione Trasparente plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 7.1. This is due to missing or incorrect nonce validation on the atsaveaturlmeta function. This makes it possible for unauthenticated attackers to update meta data vi...

Cross site request forgery (csrf)

The Event Espresso 4 Decaf plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.10.11. This is due to missing or incorrect nonce validation on the ajaxHandler function. This makes it possible for unauthenticated attackers to op into notifications vi...

CVE-2021-4403 Remove Schema <= 1.5 - Cross-Site Request Forgery Bypass

The Remove Schema plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the validate function. This makes it possible for unauthenticated attackers to modify the plugins settings via a forged...

CVE-2020-36748 Dokan <= 3.0.8 - Cross-Site Request Forgery Bypass

The Dokan plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.8. This is due to missing or incorrect nonce validation on the handleorderexport function. This makes it possible for unauthenticated attackers to trigger an order export via a forged...

CVE-2021-4396 Rucy <= 0.4.4 - Cross-Site Request Forgery Bypass

The Rucy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.4.4. This is due to missing or incorrect nonce validation on the savercpostmeta function. This makes it possible for unauthenticated attackers to save post meta via a forged request grant...

CVE-2021-4394

The Locations plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.1. This is due to missing or incorrect nonce validation on the saveCustomFields function. This makes it possible for unauthenticated attackers to update custom field meta data via ...

CVE-2020-36742

The Custom Field Template plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.1. This is due to missing or incorrect nonce validation on the editmetavalue function. This makes it possible for unauthenticated attackers to edit meta field values vi...

CVE-2020-36744

The NotificationX plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.2. This is due to missing or incorrect nonce validation on the generateconversions function. This makes it possible for unauthenticated attackers to generate conversions via a...

CVE-2020-36743

The Product Catalog Simple plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.13. This is due to missing or incorrect nonce validation on the implecodesaveproductsmeta function. This makes it possible for unauthenticated attackers to update...

Cross site request forgery (csrf)

The Custom Field Template plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.1. This is due to missing or incorrect nonce validation on the editmetavalue function. This makes it possible for unauthenticated attackers to edit meta field values vi...

CVE-2020-36745

The WP Project Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4.0. This is due to missing or incorrect nonce validation on the doupdates function. This makes it possible for unauthenticated attackers to trigger updates via a forged...

Cross site request forgery (csrf)

The WP Security Question plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.5. This is due to missing or incorrect nonce validation on the save function. This makes it possible for unauthenticated attackers to modify the plugin's settings via a...

PT-2023-12514 · WordPress · Hm Multiple Roles

Name of the Vulnerable Software and Affected Versions: Multiple Roles plugin for WordPress versions up to, and including, 1.3.1 Description: The issue is due to missing or incorrect nonce validation on the mu add roles in signup meta and mu add roles in signup meta recently functions. This allows...

PT-2023-12499

Name of the Vulnerable Software and Affected Versions Opal Estate plugin for WordPress versions up to, and including, 1.6.11 Description The issue is due to missing or incorrect nonce validation on the opalestate set feature property and opalestate remove feature property functions. This allows...

PT-2023-12507

Name of the Vulnerable Software and Affected Versions Abandoned Cart Recovery for WooCommerce plugin for WordPress versions up to, and including, 1.0.4 Description The issue is due to missing or incorrect nonce validation on the get items and extra tablenav functions, making it possible for...