CVE-2024-3943

CVE-2024-3943 affects the WordPress plugin WP To Do (versions ≤ 1.3.0). The issue is a Cross-Site Request Forgery (CSRF) vulnerability arising from missing or improper nonce validation on the function wptodo_addcomment, enabling unauthenticated attackers to add comments to to-do items via forged ...

PT-2024-28510 · WordPress · Wp To Do

Name of the Vulnerable Software and Affected Versions: WP To Do plugin for WordPress versions up to, and including, 1.3.0 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the wptodo settings function. This allows unauthenticated...

PT-2024-28501 · WordPress · Wp To Do

Name of the Vulnerable Software and Affected Versions: WP To Do plugin for WordPress versions up to, and including, 1.3.0 Description: The issue is due to missing or incorrect nonce validation on the wptodo manage function, making it possible for unauthenticated attackers to add new todo items vi...

PT-2024-31086 · WordPress · Comparison Slider

Name of the Vulnerable Software and Affected Versions: Comparison Slider plugin for WordPress versions up to, and including, 1.0.5 Description: The issue is due to missing or incorrect nonce validation on several functions hooked to AJAX actions, making it possible for unauthenticated attackers t...

WP To Do <= 1.3.0 - Cross-Site Request Forgery via wptodo_manage()

Description The WP To Do plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0. This is due to missing or incorrect nonce validation on the wptodomanage function. This makes it possible for unauthenticated attackers to add new todo items via ...

CVE-2024-4409

The WP-ViperGB plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.1. This is due to missing or incorrect nonce validation when saving plugin settings. This makes it possible for unauthenticated attackers to change the plugin's settings via a...

CVE-2024-4409 WP-ViperGB <= 1.6.1 - Cross-Site Request Forgery

The WP-ViperGB plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.1. This is due to missing or incorrect nonce validation when saving plugin settings. This makes it possible for unauthenticated attackers to change the plugin's settings via a...

CVE-2024-4409

CVE-2024-4409 : The WP-ViperGB WordPress plugin (all versions up to 1.6.1) is vulnerable to Cross-Site Request Forgery due to missing/incorrect nonce validation when saving settings. This allows unauthenticated attackers to alter plugin settings by tricking an administrator into performing an act...

PT-2024-30942 · WordPress · Wp-Vipergb

Name of the Vulnerable Software and Affected Versions: WP-ViperGB plugin for WordPress versions up to, and including, 1.6.1 Description: The issue is due to missing or incorrect nonce validation when saving plugin settings, making it possible for unauthenticated attackers to change the plugin's...

WP-ViperGB < 1.6.2 - Cross-Site Request Forgery

Description The WP-ViperGB plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.1. This is due to missing or incorrect nonce validation when saving plugin settings. This makes it possible for unauthenticated attackers to change the plugin's...

CVE-2024-1446

CVE-2024-1446 affects NextScripts: Social Networks Auto-Poster for WordPress. The vulnerability is a Cross-Site Request Forgery on the nxssnap-reposter page that allowed unauthenticated attackers to delete posts/pages via forged admin actions. It affects all versions up to and including 4.4.3. Co...

PT-2024-18052 · WordPress · Nextscripts: Social Networks Auto-Poster

Name of the Vulnerable Software and Affected Versions: NextScripts: Social Networks Auto-Poster plugin for WordPress versions up to, and including, 4.4.3 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the nxssnap-reposter page. This...

NextScripts: Social Networks Auto-Poster < 4.4.4 - Cross-Site Request Forgery to Arbitrary Post Deletion

Description The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.4.3. This is due to missing or incorrect nonce validation on the nxssnap-reposter page. This makes it possible for unauthenticated...

Integration for Contact Form 7 HubSpot <=1.3.1 - Cross-Site Request Forgery

Description The Integration for Contact Form 7 HubSpot plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.1. This is due to missing or incorrect nonce validation on the settingspage function. This makes it possible for unauthenticated attackers ...

Clearfy Cache <= 2.2.1 - Cross-Site Request Forgery

Description The Clearfy Cache plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.2.1. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to perform unauthorized actions via a forged request...

Fast Custom Social Share by CodeBard <= 1.1.2 - Cross-Site Request Forgery

Description The Fast Custom Social Share by CodeBard plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to perform unauthorized actions...

CVE-2024-4204

Bulk Posts Editing For WordPress (Plugin) is vulnerable to Cross-Site Request Forgery in all versions up to 4.2.3 due to missing or incorrect nonce validation on AJAX actions. This could allow unauthenticated attackers to create/duplicate posts, retrieve post content, and modify post taxonomy by ...

CVE-2024-4204 Bulk Posts Editing For WordPress <= 4.2.3 - Cross-Site Request Forgery

The Bulk Posts Editing For WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.3. This is due to missing or incorrect nonce validation on the plugin's AJAX actions.. This makes it possible for unauthenticated attackers to create and...

PT-2024-29706 · WordPress · Bulk Posts Editing For Wordpress

Name of the Vulnerable Software and Affected Versions: Bulk Posts Editing For WordPress plugin for WordPress versions up to, and including, 4.2.3 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the plugin's AJAX actions. This allows...

DS Site Message <= 1.14.4 - Cross-Site Request Forgery

Description The DS Site Message plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.14.4. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via...