CVE-2024-4463

CVE-2024-4463 affects the Squelch Tabs and Accordions Shortcodes WordPress plugin. The issue is a Cross-Site Request Forgery (CSRF) due to missing/incorrect nonce validation when saving plugin settings, allowing unauthenticated attackers to modify settings by tricking a site administrator into pe...

CVE-2024-4082

CVE-2024-4082 : The Joli FAQ SEO – WordPress FAQ Plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to 1.3.2 due to missing nonce validation when saving settings. This enables unauthenticated attackers to change plugin settings by inducing an administrator action....

CVE-2024-4082 Joli FAQ SEO – WordPress FAQ Plugin <= 1.3.2 - Cross-Site Request Forgery

The Joli FAQ SEO – WordPress FAQ Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.2. This is due to missing or incorrect nonce validation when saving settings. This makes it possible for unauthenticated attackers to change the...

CVE-2024-4082 Joli FAQ SEO – WordPress FAQ Plugin <= 1.3.2 - Cross-Site Request Forgery

The Joli FAQ SEO – WordPress FAQ Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.2. This is due to missing or incorrect nonce validation when saving settings. This makes it possible for unauthenticated attackers to change the...

CVE-2024-1230 SimpleShop <= 2.10.0 - Cross-Site Request Forgery

The SimpleShop plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10.0. This is due to missing or incorrect nonce validation on the maybedisconnectsimpleshop function. This makes it possible for unauthenticated attackers to disconnect the site...

CVE-2024-1230 SimpleShop <= 2.10.0 - Cross-Site Request Forgery

The SimpleShop plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10.0. This is due to missing or incorrect nonce validation on the maybedisconnectsimpleshop function. This makes it possible for unauthenticated attackers to disconnect the site...

CVE-2024-1230 SimpleShop <= 2.10.0 - Cross-Site Request Forgery

The SimpleShop plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10.0. This is due to missing or incorrect nonce validation on the maybedisconnectsimpleshop function. This makes it possible for unauthenticated attackers to disconnect the site...

CVE-2024-1230

Technical details about CVE-2024-1230 are not provided in the supplied documents. Monitor for updates from official advisories.

CVE-2024-4103 ADFO – Custom data in admin dashboard <= 1.9.0 - Cross-Site Request Forgery

The ADFO – Custom data in admin dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.0. This is due to missing or incorrect nonce validation on several functions hooked via the controller function. This makes it possible for...

CVE-2024-4103 ADFO – Custom data in admin dashboard <= 1.9.0 - Cross-Site Request Forgery

The ADFO – Custom data in admin dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.0. This is due to missing or incorrect nonce validation on several functions hooked via the controller function. This makes it possible for...

CVE-2024-4103

CVE-2024-4103 affects ADFO – Custom data in admin dashboard for WordPress. It is a CSRF vulnerability in all versions up to 1.9.0 caused by missing/incorrect nonce validation on functions hooked via the controller() function, enabling unauthenticated attackers to edit plugin settings if a site ad...

CVE-2024-4314 hostel <= 1.1.5.3 - Cross-Site Request Forgery

The Hostel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.5.3. This is due to missing or incorrect nonce validation when managing rooms. This makes it possible for unauthenticated attackers to create and delete rooms via a forged request...

CVE-2024-4314

CVE-2024-4314 affects the Hostel WordPress plugin up through version 1.1.5.3, where CSRF exists due to missing/incorrect nonce validation in room management. This allows unauthenticated attackers to trigger actions (e.g., create or delete rooms) by enticing an admin to click a crafted link. The C...

CVE-2024-4312 Soccer Engine – Soccer Plugin for WordPress <= 1.12 - Cross-Site Request Forgery

The Soccer Engine – Soccer Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12. This is due to missing or incorrect nonce validation when saving match and team settings. This makes it possible for unauthenticated attacke...

CVE-2024-4312 Soccer Engine – Soccer Plugin for WordPress <= 1.12 - Cross-Site Request Forgery

The Soccer Engine – Soccer Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12. This is due to missing or incorrect nonce validation when saving match and team settings. This makes it possible for unauthenticated attacke...

CVE-2024-4312

CVE-2024-4312 concerns the Soccer Engine – Soccer Plugin for WordPress, vulnerable to Cross-Site Request Forgery in versions up to 1.12 due to missing or incorrect nonce validation when saving match and team settings. The vulnerability could allow unauthenticated attackers to change plugin settin...

EWWW Image Optimizer < 7.3.0 - Cross-Site Request Forgery

Description The EWWW Image Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.2.3. This is due to missing or incorrect nonce validation on the checkforoptin and checkforoptout functions. This makes it possible for unauthenticated...

PT-2024-31200 · WordPress · Squelch Tabs/Accordions Shortcodes

Name of the Vulnerable Software and Affected Versions: Squelch Tabs and Accordions Shortcodes plugin for WordPress versions up to, and including, 0.4.7 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation when saving plugin settings. This...

PT-2024-30307 · WordPress · The Soccer Engine

Name of the Vulnerable Software and Affected Versions: The Soccer Engine – Soccer Plugin for WordPress versions up to, and including, 1.12 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation when saving match and team settings. This allows...

LearnPress – WordPress LMS Plugin < 4.2.6.6 - Unauthenticated Time-Based SQL Injection

Description The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the ‘termid’ parameter in versions up to, and including, 4.2.6.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...