CVE-2023-1604 Short URL <= 1.6.8 - Cross-Site Request Forgery via configuration_page

The Short URL plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.8. This is due to missing or incorrect nonce validation on the configurationpage function. This makes it possible for unauthenticated attackers to add and import redirects, includi...

CVE-2023-1604

The CVE-2023-1604 entry concerns the WordPress Short URL plugin (versions up to 1.6.8). The underlying issue is missing or incorrect nonce validation in the configuration_page function, which leads to a Cross-Site Request Forgery. As a result, unauthenticated attackers can trick a site administra...

PT-2024-12466 · WordPress · The Bricks

Name of the Vulnerable Software and Affected Versions: The Bricks theme for WordPress versions up to, and including, 1.8.1 Description: The issue is due to missing or incorrect nonce validation on the reset settings function, making it possible for unauthenticated attackers to reset the theme's...

PT-2024-12465 · WordPress · The Bricks

Name of the Vulnerable Software and Affected Versions: The Bricks theme for WordPress versions up to, and including, 1.8.1 Description: The issue is due to missing or incorrect nonce validation on the save settings function, making it possible for unauthenticated attackers to modify the theme's...

CVE-2024-7501

The Download Plugins and Themes in ZIP from Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.7. This is due to missing or incorrect nonce validation on the downloadtheme function. This makes it possible for unauthenticated...

CVE-2024-7501 Download Plugins and Themes from Dashboard <= 1.8.7 - Cross-Site Request Forgery

The Download Plugins and Themes in ZIP from Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.7. This is due to missing or incorrect nonce validation on the downloadtheme function. This makes it possible for unauthenticated...

CVE-2024-7422

The Theme My Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.1.7. This is due to missing or incorrect nonce validation on the tmladminsavemssettings function. This makes it possible for unauthenticated attackers to update the theme's...

CVE-2024-7422

CVE-2024-7422 (Theme My Login for WordPress) is a CSRF vulnerability in the Theme My Login plugin that affects multi-site WordPress installations. It arises from missing or incorrect nonce validation in the tml_admin_save_ms_settings() function, enabling an unauthenticated attacker to forge a req...

CVE-2024-7422 Theme My Login <= 7.1.7 - Cross-Site Request Forgery to Settings Update

The Theme My Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.1.7. This is due to missing or incorrect nonce validation on the tmladminsavemssettings function. This makes it possible for unauthenticated attackers to update the theme's...

CVE-2024-7420

The Insert PHP Code Snippet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.6. This is due to missing or incorrect nonce validation in the /admin/snippets.php file. This makes it possible for unauthenticated attackers to activate/deactiva...

CVE-2024-7420

CVE-2024-7420 concerns the WordPress plugin Insert PHP Code Snippet. Connected sources confirm a CSRF vulnerability across all versions up to 1.3.6 due to missing/incorrect nonce validation in /admin/snippets.php, enabling unauthenticated attackers to activate/deactivate and delete code snippets ...

PT-2024-38391 · WordPress · Download Plugins/Themes In Zip From Dashboard

Name of the Vulnerable Software and Affected Versions: Download Plugins and Themes in ZIP from Dashboard plugin for WordPress versions prior to 1.8.8 Description: The issue is due to missing or incorrect nonce validation on the download theme function, making it possible for unauthenticated...

PT-2024-38335 · WordPress · Insert Php Code Snippet

Name of the Vulnerable Software and Affected Versions: Insert PHP Code Snippet plugin for WordPress versions up to, and including, 1.3.6 Description: The issue is due to missing or incorrect nonce validation in the "/admin/snippets.php" file, making it possible for unauthenticated attackers to...

CVE-2024-7574

The Christmasify! plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.5. This is due to missing nonce validation on the 'options' function. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious...

CVE-2024-7574

The Christmasify! plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.5. This is due to missing nonce validation on the 'options' function. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious...

CVE-2024-7574 Christmasify! <= 1.5.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Christmasify! plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.5. This is due to missing nonce validation on the 'options' function. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious...

CVE-2024-7574 Christmasify! <= 1.5.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Christmasify! plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.5. This is due to missing nonce validation on the 'options' function. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious...

CVE-2024-7574

CVE-2024-7574 affects the Christmasify! WordPress plugin (versions

PT-2024-38428 · WordPress · Christmasify!

Name of the Vulnerable Software and Affected Versions: Christmasify! plugin for WordPress versions up to, and including, 1.5.5 Description: The issue is related to Cross-Site Request Forgery due to missing nonce validation on the options function. This allows unauthenticated attackers to modify t...

CVE-2024-6254

The Brizy – Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.1. This is due to missing or incorrect nonce validation on form submissions. This makes it possible for unauthenticated attackers to submit forms intended for public...