CVE-2024-3215 Paid Memberships Pro <= 3.0.1 - Cross-Site Request Forgery

The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on the pmproupdatelevelgrouporder function. Th...

CVE-2024-3215 Paid Memberships Pro <= 3.0.1 - Cross-Site Request Forgery

The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on the pmproupdatelevelgrouporder function. Th...

CVE-2024-3215

CVE-2024-3215 affects the Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions WordPress plugin. It is a CSRF vulnerability caused by missing or incorrect nonce validation in pmpro_update_level_group_order(), allowing unauthenticated attackers to update order levels...

CVE-2023-7067 ShopLentor <= 2.8.1 - Improper Authorization via woolentor_template_store

The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution formerly WooLentor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'woolentortemplatestore' function in all versions up to, and...

CVE-2023-7067

CVE-2023-7067 affects ShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules (formerly WooLentor) WordPress plugin. All versions through 2.8.1 are vulnerable to unauthorized modification of data due to a missing capability check in woolentor_template_store. An authenticated attack...

CVE-2024-1809

CVE-2024-1809 affects the Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) plugin for WordPress. The vulnerability arises from a missing capability check on AJAX functions combined with nonce leakage, impacting all versions up to and including 5.2.3. This enables an ...

CVE-2024-2959 SVS Pricing Tables <= 1.0.4 - Cross-Site Request Forgery to Pricing Table Edit/Creation

The SVS Pricing Tables plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to missing or incorrect nonce validation on the savePricingTable function. This makes it possible for unauthenticated attackers to create and edit prici...

CVE-2024-0847

CVE-2024-0847 affects the 5280 Bootstrap Modal Contact Form plugin for WordPress. The root cause is missing/incorrect nonce validation in class-sbmm-list-table.php, enabling CSRF to bulk delete messages by unauthenticated attackers if they can trick an admin into performing an action (e.g., click...

CVE-2024-0847

The 5280 Bootstrap Modal Contact Form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation in class-sbmm-list-table.php. This makes it possible for unauthenticated attackers to bulk delete...

CVE-2024-0847 5280 Bootstrap Modal Contact Form <= 1.0 - Cross-Site Request Forgery to Bulk Delete Messages

The 5280 Bootstrap Modal Contact Form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation in class-sbmm-list-table.php. This makes it possible for unauthenticated attackers to bulk delete...

CVE-2024-4083

CVE-2024-4083 highlights a CSRF vulnerability in the WordPress plugin “Easy Restaurant Table Booking” up to version 1.0.0. The root cause is missing or incorrect nonce validation when saving settings, enabling unauthenticated attackers to trigger settings changes through forged requests if a site...

CVE-2024-0613: Cross-Site Request Forgery (CSRF)

The Delete Custom Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.3.1. This is due to missing or incorrect nonce validation on the ajaxdeletefield function. This makes it possible for unauthenticated attackers to delete arbitrary pos...

PT-2024-29086 · WordPress · Easy Restaurant Table Booking

Name of the Vulnerable Software and Affected Versions: Easy Restaurant Table Booking plugin for WordPress versions up to, and including, 1.0.0 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation when saving settings. This allows...

PT-2024-15863 · WordPress · 5280 Bootstrap Modal Contact Form

Name of the Vulnerable Software and Affected Versions: 5280 Bootstrap Modal Contact Form plugin for WordPress versions up to, and including, 1.0 Description: The issue is due to missing or incorrect nonce validation in class-sbmm-list-table.php, making it possible for unauthenticated attackers to...

PT-2024-18025 · WordPress · Responsive Contact Form Builder & Lead Generation Plugin

Name of the Vulnerable Software and Affected Versions: The Responsive Contact Form Builder & Lead Generation Plugin plugin for WordPress versions up to, and including, 1.8.9 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on several...

CVE-2024-1415: Cross-Site Request Forgery (CSRF)

The Responsive Contact Form Builder & Lead Generation Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.9. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attacker...

CVE-2024-4086: Cross-Site Request Forgery (CSRF)

The CM Tooltip Glossary – Powerful Glossary Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.11. This is due to missing or incorrect nonce validation when saving settings. This makes it possible for unauthenticated attackers to chan...

CVE-2024-3215: Cross-Site Request Forgery (CSRF)

The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on the pmproupdatelevelgrouporder function. Th...

CVE-2024-1809: Exposure of Sensitive System Information to an Unauthorized Control Sphere

The Analytify – Google Analytics Dashboard For WordPress GA4 analytics made easy plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on AJAX functions in combination with nonce leakage in all versions up to, and including, 5.2.3. This makes it...

PT-2024-22941 · WordPress · Svs Pricing Tables

Name of the Vulnerable Software and Affected Versions: SVS Pricing Tables plugin for WordPress versions up to, and including, 1.0.4 Description: The issue is due to missing or incorrect nonce validation on the deletePricingTable function, making it possible for unauthenticated attackers to delete...