CVE-2024-12572

The Hello In All Languages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious...

CVE-2024-12572

CVE-2024-12572 affects the Hello In All Languages WordPress plugin (versions up to and including 1.0.6). The vulnerability is Cross-Site Request Forgery due to missing or incorrect nonce validation on a function, enabling unauthenticated attackers to update plugin settings and inject malicious sc...

CVE-2024-12572 Hello in All Languages <= 1.0.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Hello In All Languages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious...

CVE-2024-12572 Hello in All Languages <= 1.0.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Hello In All Languages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious...

PT-2024-17660

Name of the Vulnerable Software and Affected Versions Hello In All Languages plugin for WordPress versions up to, and including, 1.0.6 Description The issue is due to missing or incorrect nonce validation on a function, allowing unauthenticated attackers to update settings and inject malicious we...

CVE-2024-12414: Cross-Site Request Forgery (CSRF)

The Themify Store Locator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.9. This is due to missing or incorrect nonce validation on the settingpage function. This makes it possible for unauthenticated attackers to modify the plugin's...

CVE-2024-12572: Cross-Site Request Forgery (CSRF)

The Hello In All Languages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious...

PT-2024-17585 · WordPress · Themify Store Locator

Name of the Vulnerable Software and Affected Versions: Themify Store Locator plugin for WordPress versions up to, and including, 1.1.9 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the setting page function. This allows...

CVE-2024-12018

The Snippet Shortcodes plugin for WordPress is vulnerable to unauthorized Shortcode Deletion due to missing authorization in all versions up to, and including, 4.1.6. Note that a nonce is used as authentication here, but the value is leaked. This makes it possible for authenticated attackers, wit...

CVE-2024-12526

The Arena.IM – Live Blogging for real-time events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.4.1. This is due to missing or incorrect nonce validation on the 'albfreuseraction' AJAX action. This makes it possible for unauthenticated...

CVE-2024-12526

The Arena.IM – Live Blogging for real-time events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.3.0. This is due to missing or incorrect nonce validation on the 'albfreuseraction' AJAX action. This makes it possible for unauthenticated...

CVE-2024-12526 Arena.IM – Live Blogging for real-time events <= 0.4.1 - Cross-Site Request Forgery to Settings Update

The Arena.IM – Live Blogging for real-time events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.4.1. This is due to missing or incorrect nonce validation on the 'albfreuseraction' AJAX action. This makes it possible for unauthenticated...

CVE-2024-12526

CVE-2024-12526 : Arena.IM – Live Blogging for real-time events (WordPress) had a CSRF vulnerability due to missing nonce validation on albfre_user_action, allowing unauthenticated abuse to change plugin settings if an admin visits a forged link. Affected versions were up to 0.3.0; Wordfence notes...

CVE-2024-12526 Arena.IM – Live Blogging for real-time events <= 0.4.1 - Cross-Site Request Forgery to Settings Update

The Arena.IM – Live Blogging for real-time events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.4.1. This is due to missing or incorrect nonce validation on the 'albfreuseraction' AJAX action. This makes it possible for unauthenticated...

CVE-2024-11689

The HQ Rental Software plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.29. This is due to missing or incorrect nonce validation on the displaySettingsPage function. This makes it possible for unauthenticated attackers to update arbitrary...

CVE-2024-11417

The dejure.org Vernetzungsfunktion plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.97.5. This is due to missing or incorrect nonce validation on the djoeinstellungenmenue function. This makes it possible for unauthenticated attackers to...

CVE-2024-11419

The Password for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the get3initadminpage function. This makes it possible for unauthenticated attackers to update settings and injec...

CVE-2024-11417

CVE-2024-11417 affects the dejure.org Vernetzungsfunktion WordPress plugin. The vulnerability is Cross-Site Request Forgery due to missing/incorrect nonce validation in djo_einstellungen_menue(), affecting all versions up to 1.97.5. This enables unauthenticated attackers to update settings and in...

CVE-2024-11419 Password for WP <= 1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Password for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the get3initadminpage function. This makes it possible for unauthenticated attackers to update settings and injec...

CVE-2024-11419

CVE-2024-11419 affects the Password for WP WordPress plugin (versions up to and including 1.3). The vulnerability arises from missing or incorrect nonce validation in get3_init_admin_page(), enabling unauthenticated attackers to update plugin settings and inject script via forged requests. Wordfe...