CVE-2024-3642 Newsletter Popup <= 1.2 - Subscriber Deletion via CSRF

The Newsletter Popup WordPress plugin through 1.2 does not have CSRF check when deleting subscriber, which could allow attackers to make logged in admins perform such action via a CSRF attack...

CVE-2024-3642 Newsletter Popup <= 1.2 - Subscriber Deletion via CSRF

The Newsletter Popup WordPress plugin through 1.2 does not have CSRF check when deleting subscriber, which could allow attackers to make logged in admins perform such action via a CSRF attack...

CVE-2024-3642

The CVE-2024-3642 entry concerns the WordPress plugin Newsletter Popup (versions up to 1.2). The core issue is a missing CSRF check when deleting a subscriber, enabling an attacker to coerce a logged-in admin into performing deletion via CSRF. Impact is administrative action without authenticatio...

CVE-2024-3643 Newsletter Popup <= 1.2 - List Deletion via CSRF

The Newsletter Popup WordPress plugin through 1.2 does not have CSRF check when deleting list, which could allow attackers to make logged in admins perform such action via a CSRF attack...

CVE-2024-3641 Newsletter Popup <= 1.2 - Unauthenticated Stored XSS

The Newsletter Popup WordPress plugin through 1.2 does not sanitise and escape some parameters, which could allow unauthenticated visitors to perform Cross-Site Scripting attacks against admins...

PT-2024-26976 · WordPress · Newsletter Popup

Name of the Vulnerable Software and Affected Versions: The Newsletter Popup WordPress plugin versions prior to 1.3 Description: The issue allows unauthenticated visitors to perform Cross-Site Scripting attacks against admins due to the plugin not sanitising and escaping some parameters. This coul...

PT-2024-26999 · WordPress · Newsletter Popup

Name of the Vulnerable Software and Affected Versions: Newsletter Popup WordPress plugin versions 1.2 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly sanitised a...

PT-2024-26987 · WordPress · Newsletter Popup

Name of the Vulnerable Software and Affected Versions: The Newsletter Popup WordPress plugin versions prior to 1.3 Description: The issue concerns a lack of CSRF check when deleting a subscriber, which could allow attackers to make logged-in admins perform such an action via a CSRF attack...

WordPress Newsletter Popup Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)

Software Newsletter Popup Type Plugin Vulnerable versions = 1.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3644 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 7dd3456f2155 Credits Bob Matyas Required privile...

ITPison OMICARD EDM 代码问题漏洞

ITPison OMICARD EDM is a high-speed newsletter EDM marketing and distribution system from China-based ITPison. A code issue vulnerability exists in ITPison OMICARD EDM versions prior to v6.0 that stems from the inability to properly filter specific URL parameters, which allows an unauthenticated,...

CVE-2024-34823

Cross-Site Request Forgery CSRF vulnerability in Kiboko Labs Arigato Autoresponder and Newsletter.This issue affects Arigato Autoresponder and Newsletter: from n/a through 2.7.2.3...

CVE-2024-34823

CVE-2024-34823 affects the Kiboko Labs Arigato Autoresponder and Newsletter WordPress plugin. Public data confirms a Cross-Site Request Forgery (CSRF) vulnerability for Arigato Autoresponder and Newsletter releases from before or equal to version 2.7.2.3. The entry specifies the affected product ...

CVE-2024-34823 WordPress Arigato Autoresponder and Newsletter plugin <= 2.7.2.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Kiboko Labs Arigato Autoresponder and Newsletter.This issue affects Arigato Autoresponder and Newsletter: from n/a through 2.7.2.3...

WordPress Arigato Autoresponder and Newsletter plugin <= 2.7.2.3 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin Arigato Autoresponder and Newsletter versions = 2.7.2.3...

WordPress Arigato Autoresponder and Newsletter Plugin <= 2.7.2.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Arigato Autoresponder and Newsletter Type Plugin Vulnerable versions = 2.7.2.3 Fixed in 2.7.2.4 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-34823 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID c69fbb99557f...

CVE-2024-34568 WordPress LetterPress Newsletter plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Themeqx LetterPress allows Stored XSS.This issue affects LetterPress: from n/a through 1.2.1...

WordPress LetterPress Newsletter plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by P.L.SANU Patchstack Alliance in WordPress Plugin LetterPress versions = 1.2.1...

WooCommerce AWeber Newsletter Subscription < 4.0.3 - Missing Authorization to Access Token Modification

Description The WooCommerce AWeber Newsletter Subscription plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on a function in all versions up to, and including, 4.0.2. This makes it possible for unauthenticated attackers to reset and change...

CVE-2024-33944

Missing Authorization vulnerability in Kestrel WooCommerce AWeber Newsletter Subscription.This issue affects WooCommerce AWeber Newsletter Subscription: from n/a through 4.0.2...

CVE-2024-33944 WordPress WooCommerce AWeber Newsletter Subscription plugin <= 4.0.2 - Unauthenticated Access Token Change/Reset vulnerability

Missing Authorization vulnerability in Kestrel WooCommerce AWeber Newsletter Subscription.This issue affects WooCommerce AWeber Newsletter Subscription: from n/a through 4.0.2...