WP Forms Puzzle Captcha <= 4.1 - Cross-Site Request Forgery to Cross-Site Scripting

Description The WP Forms Puzzle Captcha plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.1. This is due to missing or incorrect nonce validation on one of its functions. This makes it possible for unauthenticated attackers to invoke this functio...

Bulk Comment Remove <= 2 - Cross-Site Request Forgery via brc_admin()

Description The Bulk Comment Remove plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2. This is due to missing or incorrect nonce validation on the brcadmin function. This makes it possible for unauthenticated attackers to delete comments in bulk...

Simple Testimonials Showcase <= 1.1.5 - Cross-Site Request Forgery

Description The Simple Testimonials Showcase plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.5. This is due to missing or incorrect nonce validation on the stssavesettings function. This makes it possible for unauthenticated attackers to upda...

Decorator - WooCommerce Email Customizer < 1.2.8 - Cross-Site Request Forgery

Description The Decorator – WooCommerce Email Customizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.7. This is due to missing nonce validation on several functions such as ajaxreset, wtdecoratorbuttontext, wtdecoratorsetasdefault, an...

Broken Link Checker for YouTube <= 1.3 - Cross-Site Request Forgery via plugin_settings_page()

Description The Broken Link Checker for YouTube plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3. This is due to missing or incorrect nonce validation on the pluginsettingspage function. This makes it possible for unauthenticated attackers to...

League Table < 1.14 - Tables Cloning/Update/Deletion via CSRF

Description The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation in the view/tables.php file. This makes it possible for unauthenticated attackers to clone, edit, update, and delete tables via a forged request granted they can trick a site...

Frontier Post <= 6.1 - Cross-Site Request Forgery

Description The Frontier Post plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.1. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an unauthorized action...

CVE-2023-5525

The Limit Login Attempts Reloaded WordPress plugin before 2.25.26 is missing authorization on the toggleautoupdate AJAX action, allowing any user with a valid nonce to toggle the auto-update status of the plugin...

CVE-2023-5525

CVE-2023-5525 affects the Limit Login Attempts Reloaded WordPress plugin prior to 2.25.26. The root cause is missing authorization on the toggle_auto_update AJAX action, allowing any user with a valid nonce to toggle the plugin’s auto-update status. Impact: potential unauthorized control of auto-...

WooCommerce Canada Post Shipping < 2.8.4 - Cross-Site Request Forgery

Description The WooCommerce Canada Post Shipping plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.3. This is due to missing or incorrect nonce validation on one of its functions. This makes it possible for unauthenticated attackers to invoke...

GiveWP < 2.33.4 - Cross-Site Request Forgery to Stripe Integration Deletion

Description The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the givestripedisconnectconnectstripeaccount function. This makes it possible for unauthenticated attackers to...

WooCommerce Subscription < 4.6.0 - Cross-Site Request Forgery

Description The WooCommerce Subscription for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and not including, 4.6.0. This is due to missing or incorrect nonce validation when suspending or canceling subscriptions. This makes it possible for unauthenticated attackers to...

Simple 301 Redirects < 2.0.8 - Cross-Site Request Forgery via 'clicked'

Description The Simple 301 Redirects plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.7. This is due to missing or incorrect nonce validation on the 'clicked' function. This makes it possible for unauthenticated attackers to enable or disable...

Backup Migration < 1.3.0 - Cross-Site Request Forgery

Description The Backup Migration plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.9. This is due to missing nonce validation on the ajax function, or BMIAjax class. This makes it possible for unauthenticated attackers to control any of the...

WP Meta and Date Remover < 2.3.1 - Cross-Site Request Forgery via updateSettings

Description The WP Meta and Date Remover plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.0. This is due to missing or incorrect nonce validation on the updateSettings function. This makes it possible for unauthenticated attackers to chang...

Checkout Field Editor < 1.7.5 - Cross-Site Request Forgery to Checkout Fields Update

Description The Checkout Field Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.4. This is due to missing nonce validation when updating checkout fields. This makes it possible for unauthenticated attackers to update checkout fields via...

Stripe Gateway < 7.6.1 - Cross-Site Request Forgery

Description The WooCommerce Stripe Payment Gateway plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to 7.6.1 exclusive. This is due to missing or incorrect nonce validation on the maybehandleredirect function. This makes it possible for unauthenticated attackers...

ProfilePress < 4.13.2 Cross-Site Request Forgery via 'admin_notice'

Description The ProfilePress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.13.1. This is due to missing or incorrect nonce validation on the 'adminnotice' function. This makes it possible for unauthenticated attackers to dismiss admin notices...

GiveWP < 2.33.4 - Cross-Site Request Forgery to plugin installation

Description The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the givesendwpremoteinstallhandler function. This makes it possible for unauthenticated attackers to install an...

Best Restaurant Menu by PriceListo <= 1.3.1 - Cross-Site Request Forgery via menu_page

Description The Best Restaurant Menu by PriceListo plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.1. This is due to missing or incorrect nonce validation on the menupage function. This makes it possible for unauthenticated attackers to modif...