CVE-2020-36736

CVE-2020-36736 affects the WordPress plugin WooCommerce Checkout & Funnel Builder by CartFlows (versions up to 1.5.15). The root cause is missing or incorrect nonce validation on export_json, import_json, and status_logs_file functions, enabling Cross-Site Request Forgery. This can allow unauthen...

CVE-2020-36735

The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.3. This is due to missing or incorrect nonce validation on the handleleavecalendarfilter,...

CVE-2020-36735

The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.3. This is due to missing or incorrect nonce validation on the handleleavecalendarfilter,...

CVE-2020-36735 WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.6.3 - Cross-Site Request Forgery Bypass

The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.3. This is due to missing or incorrect nonce validation on the handleleavecalendarfilter,...

PT-2023-12511 · WordPress · Edwiser Bridge

Name of the Vulnerable Software and Affected Versions: Edwiser Bridge plugin for WordPress versions up to, and including, 2.0.6 Description: The issue is due to missing or incorrect nonce validation on several functions, including user data synchronization initiater, course synchronization...

PT-2023-12517 · WordPress · Elasticpress

Name of the Vulnerable Software and Affected Versions: ElasticPress plugin for WordPress versions up to, and including, 3.5.3 Description: The issue is due to missing or incorrect nonce validation on the epio send autosuggest allowed function, making it possible for unauthenticated attackers to...

PT-2023-12516 · WordPress · Event Espresso 4 Decaf

Name of the Vulnerable Software and Affected Versions: Event Espresso 4 Decaf plugin for WordPress versions up to, and including, 4.10.11 Description: The issue is due to missing or incorrect nonce validation on the ajaxHandler function, making it possible for unauthenticated attackers to opt int...

PT-2023-11880 · WordPress · Radio Buttons For Taxonomies

Name of the Vulnerable Software and Affected Versions: Radio Buttons for Taxonomies plugin for WordPress versions up to, and including, 2.0.5 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the save single term function. This allows...

PT-2023-12498 · WordPress · Wp Security Question

Name of the Vulnerable Software and Affected Versions: WP Security Question plugin for WordPress versions up to, and including, 1.0.5 Description: The issue is due to missing or incorrect nonce validation on the save function, making it possible for unauthenticated attackers to modify the plugin'...

PT-2023-12513 · WordPress · Style Kits

Name of the Vulnerable Software and Affected Versions: The Style Kits plugin for WordPress versions up to, and including, 1.8.0 Description: The issue is due to missing or incorrect nonce validation on the update posts stylekit function, making it possible for unauthenticated attackers to update...

PT-2023-12497 · WordPress · Wp Private Content Plus

Name of the Vulnerable Software and Affected Versions: WP Private Content Plus plugin for WordPress versions up to and including 3.1 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the save groups function. This allows unauthenticate...

PT-2023-11879 · WordPress · Feed Them Social

Name of the Vulnerable Software and Affected Versions: Feed Them Social – Page, Post, Video, and Photo Galleries plugin for WordPress versions up to, and including, 2.8.6 Description: The issue is due to missing or incorrect nonce validation on the my fts fb load more function, making it possible...

PT-2023-12515 · WordPress · Remove Schema Plugin

Name of the Vulnerable Software and Affected Versions: Remove Schema plugin for WordPress versions up to, and including, 1.5 Description: The issue is due to missing or incorrect nonce validation on the validate function, making it possible for unauthenticated attackers to modify the plugin's...

PT-2023-12502 · WordPress · Contact Form 7 Style

Name of the Vulnerable Software and Affected Versions: Contact Form 7 Style plugin for WordPress versions up to, and including, 3.2 Description: The issue is due to missing or incorrect nonce validation on the manage wp posts be qe save post function, making it possible for unauthenticated...

PT-2023-11877 · WordPress · Import / Export Customizer Settings

Name of the Vulnerable Software and Affected Versions: Import / Export Customizer Settings plugin for WordPress versions up to, and including, 1.0.3 Description: The issue is due to missing or incorrect nonce validation on the astra admin errors function, making it possible for unauthenticated...

PT-2023-12512 · WordPress · The Better Search

Name of the Vulnerable Software and Affected Versions: The Better Search plugin for WordPress versions up to, and including, 2.5.2 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the bsearch process settings import and bsearch proces...

PT-2023-12505 · WordPress · Ecommerce Product Catalog Plugin

Name of the Vulnerable Software and Affected Versions: eCommerce Product Catalog Plugin for WordPress versions up to, and including, 3.0.17 Description: The issue is due to missing or incorrect nonce validation on the save function, making it possible for unauthenticated attackers to save manual...

PT-2023-11888 · WordPress · Dokan

Name of the Vulnerable Software and Affected Versions: Dokan plugin for WordPress versions up to, and including, 3.0.8 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the handle order export function. This allows unauthenticated...

PT-2023-11885 · WordPress · Wp Project Manager

Name of the Vulnerable Software and Affected Versions: WP Project Manager plugin for WordPress versions up to, and including, 2.4.0 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the do updates function. This allows unauthenticated...

PT-2023-11883 · WordPress · Product Catalog Simple

Name of the Vulnerable Software and Affected Versions: Product Catalog Simple plugin for WordPress versions up to, and including, 1.5.13 Description: The issue is due to missing or incorrect nonce validation on the implecode save products meta function, making it possible for unauthenticated...