CVE-2024-0830

The CVE-2024-0830 issue affects the WordPress plugin Comments Extra Fields For Post,Pages and CPT. The vulnerability is a CSRF flaw caused by missing or incorrect nonce validation on several AJAX actions, enabling unauthenticated attackers to trigger those actions by deceiving an admin (e.g., cli...

CVE-2024-0830 Comments Extra Fields For Post,Pages and CPT <= 5.0 - Cross-Site Request Forgery

The Comments Extra Fields For Post,Pages and CPT plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0. This is due to missing or incorrect nonce validation on several ajax actions. This makes it possible for unauthenticated attackers to invoke...

CVE-2024-0592 Related Posts for WordPress <= 2.2.1 - Cross-Site Request Forgery

The Related Posts for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.1. This is due to missing or incorrect nonce validation on the handlecreatelink function. This makes it possible for unauthenticated attackers to add related...

CVE-2024-0592 Related Posts for WordPress <= 2.2.1 - Cross-Site Request Forgery

The Related Posts for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.1. This is due to missing or incorrect nonce validation on the handlecreatelink function. This makes it possible for unauthenticated attackers to add related...

CVE-2024-1642 MainWP Dashboard <= 4.6.0.1 - Cross-Site Request Forgery via posting_bulk

The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.0.1. This is due to missing or incorrect nonce validation on the 'postingbulk' function. This makes it possible for...

CVE-2024-1642 MainWP Dashboard <= 4.6.0.1 - Cross-Site Request Forgery via posting_bulk

The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6.0.1. This is due to missing or incorrect nonce validation on the 'postingbulk' function. This makes it possible for...

CVE-2015-10130

The Team Circle Image Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing or incorrect nonce validation on the circlethumbnailsliderwithlightboximagemanagementfunc function. This makes it possible for unauthenticated attacke...

CVE-2015-10130

The Team Circle Image Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing or incorrect nonce validation on the circlethumbnailsliderwithlightboximagemanagementfunc function. This makes it possible for unauthenticated attacke...

PT-2024-10563

Name of the Vulnerable Software and Affected Versions The Team Circle Image Slider With Lightbox plugin for WordPress version 1.0 Description The issue is due to missing or incorrect nonce validation on the circle thumbnail slider with lightbox image management func function, making it possible f...

CVE-2015-10130: Cross-Site Request Forgery (CSRF)

The Team Circle Image Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing or incorrect nonce validation on the circlethumbnailsliderwithlightboximagemanagementfunc function. This makes it possible for unauthenticated attacke...

Auto Affiliate Links < 6.4.2.8 - Cross-Site Request Forgery

Description The plugin is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.4.2.7. This is due to missing or incorrect nonce validation on the wpaalstats function. This makes it possible for unauthenticated attackers to reset stats via a forged request granted they...

Related Posts for WordPress < 2.2.2 - Cross-Site Request Forgery

Description The Related Posts for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.1. This is due to missing or incorrect nonce validation on the handlecreatelink function. This makes it possible for unauthenticated attackers to...

InstaWP Connect < 0.1.0.9 - Cross-Site Request Forgery via create_file_db_manager

Description The plugin is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1.0.8. This is due to missing or incorrect nonce validation on the createfiledbmanager function. This makes it possible for unauthenticated attackers to make use of the file and database...

PT-2024-18088 · WordPress · Sms Alert Order Notifications

Name of the Vulnerable Software and Affected Versions: SMS Alert Order Notifications – WooCommerce plugin for WordPress versions up to, and including, 3.6.9 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the processBulkAction...

PT-2024-15846

Name of the Vulnerable Software and Affected Versions Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio plugin for WordPress versions up to, and including, 3.6.4 Description The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on severa...

CVE-2024-0827: Cross-Site Request Forgery (CSRF)

The Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.4. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticat...

CVE-2024-1214 Easy Social Feed <= 6.5.4 - Cross-Site Request Forgery

The Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.5.4. This is due to missing or incorrect nonce validation on the savegroupslist function. This makes it possible for...

CVE-2024-1214

CVE-2024-1214 (Easy Social Feed – Social Photos Gallery – Post Feed – Like Box, WordPress) is a CSRF vulnerability in the plugin across all versions up to 6.5.4 due to missing or incorrect nonce validation on the save_groups_list function. This allows unauthenticated attackers to disconnect a sit...

CVE-2024-1503

CVE-2024-1503 affects Tutor LMS – eLearning and online course solution (WordPress) up to version 2.6.1. Root cause: missing/incorrect nonce validation in erase_tutor_data(), enabling CSRF. Impact: unauthenticated attackers can deactivate the plugin and erase data via forged requests if the "Erase...

CVE-2024-1213 Easy Social Feed <= 6.5.4 - Cross-Site Request Forgery

The Easy Social Feed – Social Photos Gallery – Post Feed – Like Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.5.4. This is due to missing or incorrect nonce validation on the esfinstasaveaccesstoken and efblsavefacebookaccesstoken...