WordPress Plugin Sell Media 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

PT-2023-11892 · WordPress · The Coming Soon Page & Maintenance Mode

Name of the Vulnerable Software and Affected Versions: Coming Soon & Maintenance Mode Page plugin for WordPress versions up to, and including, 1.57 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the save meta box function. This allo...

PT-2023-12519 · WordPress · Custom Banners

Name of the Vulnerable Software and Affected Versions: Custom Banners plugin for WordPress versions up to and including 3.2.2 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the saveCustomFields function. This allows unauthenticated...

PT-2023-12524 · WordPress · Wp Prayer

Name of the Vulnerable Software and Affected Versions: WP Prayer plugin for WordPress versions up to, and including, 1.6.5 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the save and export functions. This allows unauthenticated...

PT-2023-12520 · WordPress · Dw Question & Answer Pro

Name of the Vulnerable Software and Affected Versions: DW Question & Answer plugin for WordPress versions up to, and including, 1.5.8 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the update answer function. This allows...

PT-2023-12537 · WordPress · Slider Hero

Name of the Vulnerable Software and Affected Versions: Slider Hero plugin for WordPress versions up to and including 8.2.0 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the qc slider hero duplicate function. This allows...

PT-2023-12522 · WordPress · Qtranslate Slug

Name of the Vulnerable Software and Affected Versions: Qtranslate Slug plugin for WordPress versions up to and including 1.1.18 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the save postdata function. This allows unauthenticated...

PT-2023-12526 · WordPress · Abandoned Cart Lite For Woocommerce

Name of the Vulnerable Software and Affected Versions: Abandoned Cart Lite for WooCommerce plugin for WordPress versions up to and including 5.8.5 Description: The issue arises from missing or incorrect nonce validation on the wcal preview emails function, allowing unauthenticated attackers to...

PT-2023-12539 · WordPress · Absolute Reviews

Name of the Vulnerable Software and Affected Versions: Absolute Reviews plugin for WordPress versions up to, and including, 1.0.8 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the metabox review save function. This allows...

PT-2023-12523 · WordPress · Wp Easypay – Square

Name of the Vulnerable Software and Affected Versions: WP EasyPay – Square for WordPress plugin versions up to, and including, 3.2.0 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the wpep download transaction in excel function. Thi...

PT-2023-12527 · WordPress · Sunshine Photo Cart

Name of the Vulnerable Software and Affected Versions: Sunshine Photo Cart plugin for WordPress versions up to, and including, 2.8.28 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the sunshine products quicksave post function. This...

PT-2023-12528 · WordPress · Wp-Mpdf

Name of the Vulnerable Software and Affected Versions: wp-mpdf plugin for WordPress versions up to, and including, 3.5.1 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the mpdf admin savepost function. This allows unauthenticated...

PT-2023-23558 · WordPress · Mstore Api

Name of the Vulnerable Software and Affected Versions: MStore API plugin for WordPress affected versions not specified Description: The issue is related to Cross-Site Request Forgery due to missing nonce validation on the mstore update status order title function. This allows unauthenticated...

CVE-2023-2079

The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the recievepost, bmcdisconnect, namepost, and widgetpost functions in versions up to, and including, 3.7. This makes it possible for unauthenticated...

Cross site request forgery (csrf)

The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the recievepost, bmcdisconnect, namepost, and widgetpost functions in versions up to, and including, 3.7. This makes it possible for unauthenticated...

CVE-2023-2079 Buy Me a Coffee – Button and Widget Plugin <= 3.7 - Cross-Site Request Forgery

The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the recievepost, bmcdisconnect, namepost, and widgetpost functions in versions up to, and including, 3.7. This makes it possible for unauthenticated...

CVE-2023-2079 Buy Me a Coffee – Button and Widget Plugin <= 3.7 - Cross-Site Request Forgery

The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the recievepost, bmcdisconnect, namepost, and widgetpost functions in versions up to, and including, 3.7. This makes it possible for unauthenticated...

WordPress Happy Addons for Elementor Plugin < 3.8.3 CSRF Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wedevs:happyaddonsforelementor"; if description...

ARMember < 4.0.6 - ARMember Cross-Site Request Forgery

The plugin does not properly validate nonces in the armcheckusercap function, leading to a potential Cross-Site Request Forgery vulnerability. As a result, unauthenticated users can carry out actions without appropriate permissions, provided they manage to mislead a site administrator into clicki...

CVE-2021-4401

The Style Kits plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.0. This is due to missing or incorrect nonce validation on the updatepostsstylekit function. This makes it possible for unauthenticated attackers to update style kits for posts vi...