116 matches found
CVE-2025-9896 HidePost <= 2.3.8 - Cross-Site Request Forgery
The HidePost plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.8. This is due to missing or incorrect nonce validation on the options.php settings page. This makes it possible for unauthenticated attackers to modify plugin settings via a...
PT-2025-39715
Name of the Vulnerable Software and Affected Versions HidePost plugin for WordPress versions prior to 2.3.9 Description The software is susceptible to Cross-Site Request Forgery CSRF due to missing or incorrect nonce validation on the options.php settings page. This allows unauthenticated attacke...
CVE-2025-7686 weichuncai(WP伪春菜) <= 1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
The weichuncaiWP伪春菜 plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the sm-options.php page. This makes it possible for unauthenticated attackers to update settings and inject...
CVE-2025-7686
CVE-2025-7686 refers to a CSRF-to-Stored XSS vulnerability in the WordPress plugin weichuncai(WP伪春菜) up to version 1.5, caused by missing or incorrect nonce validation on sm-options.php. Exploitation requires social engineering to persuade an admin to perform an action (e.g., clicking a forged li...
PT-2025-33534 · WordPress · Weichuncai
Name of the Vulnerable Software and Affected Versions: weichuncaiWP伪春菜 plugin for WordPress versions up to and including 1.5 Description: The weichuncaiWP伪春菜 plugin for WordPress is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation on the sm-options.php page...
VulnCheck KEV: CVE-2002-1131
Cross-site scripting vulnerabilities in SquirrelMail 1.2.7 and earlier allows remote attackers to execute script as other web users via 1 addressbook.php, 2 options.php, 3 search.php, or 4 help.php...
CVE-2015-9387
The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/options-general.php CSRF...
PT-2024-37542 · WordPress · Scrollto Bottom
Name of the Vulnerable Software and Affected Versions: ScrollTo Bottom plugin for WordPress versions up to, and including, 1.1.1 Description: The issue is due to missing nonce validation and missing file type validation in the options page function, making it possible for unauthenticated attacker...
CVE-2024-6082
A vulnerability, which was classified as problematic, has been found in PHPVibe 11.0.46. This issue affects some unknown processing of the file functionalities.global.php of the component Global Options Page. The manipulation of the argument site-logo-text leads to cross site scripting. The attac...
CVE-2024-6082 PHPVibe Global Options Page functionalities.global.php cross site scripting
A vulnerability, which was classified as problematic, has been found in PHPVibe 11.0.46. This issue affects some unknown processing of the file functionalities.global.php of the component Global Options Page. The manipulation of the argument site-logo-text leads to cross site scripting. The attac...
CVE-2024-6082 PHPVibe Global Options Page functionalities.global.php cross site scripting
A vulnerability, which was classified as problematic, has been found in PHPVibe 11.0.46. This issue affects some unknown processing of the file functionalities.global.php of the component Global Options Page. The manipulation of the argument site-logo-text leads to cross site scripting. The attac...
PT-2024-37372 · Phpvibe · Phpvibe
Name of the Vulnerable Software and Affected Versions: PHPVibe version 11.0.46 Description: A problematic issue has been found in the Global Options Page component, specifically in the file functionalities.global.php. The manipulation of the site-logo-text argument leads to cross-site scripting...
CVE-2021-25117
The WP-PostRatings WordPress plugin before 1.86.1 does not sanitise the postratingsimage parameter from its options page wp-admin/admin.php?page=wp-postratings/postratings-options.php. Even though the page is only accessible to administrators, and protected against CSRF attacks, the issue is stil...
CVE-2021-25117
The WP-PostRatings WordPress plugin before 1.86.1 does not sanitise the postratingsimage parameter from its options page wp-admin/admin.php?page=wp-postratings/postratings-options.php. Even though the page is only accessible to administrators, and protected against CSRF attacks, the issue is stil...
WordPress plugin WP-PostRatings security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. The WordPress plugin WP-PostRatings...
WordPress Plugin WP-CopyProtect 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
Cross site scripting
A vulnerability was found in Fancy Gallery Plugin 1.5.12 on WordPress. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file class.options.php of the component Options Page. The manipulation leads to cross site scripting. The attack can be...
CVE-2014-125096
CVE-2014-125096 affects Fancy Gallery Plugin 1.5.12 for WordPress. The vulnerability arises in an unknown function of the file class.options.php within the Options Page, enabling cross-site scripting through remote manipulation. Upgrading to version 1.5.13 addresses the issue (patch: fdf1f9e5a1ec...
SUSE CVE-2016-6893
Cross-site request forgery CSRF vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim's account...