WordPress Thrive Architect premium plugin <= 2.6.7.3 - Unauthenticated Option Update vulnerability

Unauthenticated Option Update vulnerability discovered by WordFence in WordPress Thrive Architect premium plugin versions = 2.6.7.3. Solution Update the WordPress Thrive Architect premium plugin to the latest available version at least 2.6.7.4...

Thrive Apprentice premium plugin <= 2.3.9.3 - Unauthenticated Option Update vulnerability

Unauthenticated Option Update vulnerability discovered by WordFence in Thrive Apprentice premium plugin versions = 2.3.9.3. Solution Update the Thrive Apprentice premium plugin to the latest available version at least 2.3.9.4...

WordPress Thrive Ultimatum premium plugin <= 2.3.9.3 - Unauthenticated Option Update vulnerability

Unauthenticated Option Update vulnerability discovered by WordFence in WordPress Thrive Ultimatum premium plugin versions = 2.3.9.3. Solution Update the WordPress Thrive Ultimatum premium plugin to the latest available version at least 2.3.9.4...

All Thrive Themes and Plugins - Unauthenticated Option Update

The plugins and themes register a REST API endpoint associated with Zapier functionality. While this endpoint was intended to require an API key in order to access, it was possible to access it by supplying an empty apikey parameter in vulnerable versions if Zapier was not enabled. Attackers coul...

CVE-2015-9475

The CVE-2015-9475 entry corresponds to the Pont theme 1.5 for WordPress, which has insufficient restrictions on option updates. Connected sources describe a privilege-escalation vulnerability where any authenticated user can trigger option changes (e.g., user roles, registration state) via expose...

WordPress Hybrid Composer Plugin Arbitrary Option Update

An arbitrary option update vulnerability exists in WordPress Hybrid Composer plugin. A remote authenticated attacker may exploit this vulnerability to gain administrator privileges...

WP Better Permalinks <= 3.0.4 - CSRF allowing Option Update

The WP Better Permalinks WordPress plugin was affected by a CSRF allowing Option Update security vulnerability...

LiveChat <= 3.7.2 - Unauthenticated Option Update/Reset and Stored XSS

The lack of proper CSRF and Authorisation checks could allow an unauthenticated attacker to update or reset the plugin's settings. Furthermore, when updating the livechatemail option, no sanitisation is performed, leading to a Stored XSS issue in the plugin's settings page. CSRF and XSS fixed in...

LiveChat <= 3.7.2 - Unauthenticated Option Update/Reset and Stored XSS

The lack of proper CSRF and Authorisation checks could allow an unauthenticated attacker to update or reset the plugin's settings. Furthermore, when updating the livechatemail option, no sanitisation is performed, leading to a Stored XSS issue in the plugin's settings page. CSRF and XSS fixed in...

User Email Verification for WooCommerce <= 3.3.0 - CSRF leading to Option Update

The User Email Verification for WooCommerce WordPress plugin was affected by a CSRF leading to Option Update security vulnerability...

WordPress Yellow Pencil Plugin Privilege Escalation

An Option Update vulnerability exists in WordPress Yellow Pencil Plugin. Successful exploitation of this vulnerability could lead to modification of any options of the affected site...

VulnCheck KEV: CVE-2019-11886

The WaspThemes Visual CSS Style Editor aka yellow-pencil-visual-theme-customizer plugin before 7.2.1 for WordPress allows ypoptionupdate CSRF, as demonstrated by use of ypremoteget to obtain admin access...

WordPress 404 to 301 plugin <= 3.0.1 - Authenticated Option Update vulnerability (Fremius Library security issue)

Authenticated Option Update vulnerability Fremius Library security issue found in WordPress 404 to 301 plugin versions = 3.0.1. Solution Update the WordPress 404 to 301 plugin to the latest available version at least 3.0.2...

WordPress Contact Form 7 Multi-Step Forms plugin <= 3.0.8 - Authenticated Option Update vulnerability (Fremius Library security issue)

Authenticated Option Update vulnerability Fremius Library security issue found in WordPress Contact Form 7 Multi-Step Forms plugin versions = 3.0.8. Solution Update the WordPress Contact Form 7 Multi-Step Forms plugin to the latest available version at least 3.0.9...

WordPress BuddyForms plugin <= 2.3.1 - Authenticated Option Update vulnerability (Fremius Library security issue)

Authenticated Option Update vulnerability Fremius Library security issue found in WordPress BuddyForms plugin versions = 2.3.1. Solution Update the WordPress BuddyForms plugin to the latest available version at least 2.3.2...

WordPress WP Affiliate Disclosure plugin <=1.1.3 - Authenticated Option Update vulnerability (Fremius Library security issue)

Authenticated Option Update vulnerability Fremius Library security issue found in WordPress WP Affiliate Disclosure plugin versions =1.1.3. Solution Update the WordPress WP Affiliate Disclosure plugin to the latest available version at least 1.1.4...

WordPress Delete Duplicate Posts plugin <= 4.1.9.4 - Authenticated Option Update vulnerability (Fremius Library security issue)

Authenticated Option Update vulnerability Fremius Library security issue in WordPress Delete Duplicate Posts plugin versions = 4.1.9.4. Solution Update the WordPress Delete Duplicate Posts plugin to the latest available version at least 4.1.9.5...

WordPress Content Aware Sidebars plugin <= 3.8 - Authenticated Option Update vulnerability (Fremius Library security issue)

Authenticated Option Update vulnerability Fremius Library security issue found in WordPress Content Aware Sidebars plugin versions = 3.8. Solution Update the WordPress Content Aware Sidebars plugin to the latest available version at least 3.8.1...

WordPress FooBox Image Lightbox plugin <= 2.6.3 - Authenticated Option Update vulnerability (Fremius Library security issue)

Authenticated Option Update vulnerability Fremius Library security issue found in WordPress FooBox Image Lightbox plugin versions = 2.6.3. Solution Update the WordPress FooBox Image Lightbox plugin to the latest available version at least 2.6.4...

WordPress Stop User Enumeration plugin <=1.3.19 - Authenticated Option Update vulnerability (Fremius Library security issue)

Authenticated Option Update vulnerability Fremius Library security issue found in WordPress Stop User Enumeration plugin versions =1.3.19. Solution Update the WordPress Stop User Enumeration plugin to the latest available version at least 1.3.20...