PT-2023-23886 · WordPress · Designs & Code Forget About Shortcode Buttons

Name of the Vulnerable Software and Affected Versions: Designs & Code Forget About Shortcode Buttons plugin versions = 2.1.2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions ...

PT-2023-24649 · WordPress · Malinky Ajax Pagination/Infinite Scroll

Name of the Vulnerable Software and Affected Versions: Malinky Ajax Pagination and Infinite Scroll plugin versions = 2.0.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application tha...

PT-2023-24707 · Sakura Internet Inc. · Ts Webfonts For さくらのレンタルサーバ

Name of the Vulnerable Software and Affected Versions: SAKURA Internet Inc. TS Webfonts for さくらのレンタルサーバ plugin versions = 3.1.2 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing...

PT-2023-20400 · Unknown · Frédéric Sheedy Etsy Shop

Name of the Vulnerable Software and Affected Versions: Frédéric Sheedy Etsy Shop plugin versions = 3.0.3 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could potentially trick a user into performing unintended actions on the web...

PT-2023-30372 · WordPress · I Thirteen Web Solution Post Sliders & Post Grids

Name of the Vulnerable Software and Affected Versions: I Thirteen Web Solution Post Sliders & Post Grids plugin versions = 1.0.20 Description: The issue is related to an Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with administrative access can...

PT-2023-30375 · WordPress · Vyas Dipen Top 25 Social Icons

Name of the Vulnerable Software and Affected Versions: Vyas Dipen Top 25 Social Icons plugin versions = 3.1 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. It affects users with contributor or higher permissions. There is no information provided about the...

PT-2023-30378 · WordPress · Bainternet Shortcodes Ui

Name of the Vulnerable Software and Affected Versions: Bainternet ShortCodes UI plugin versions 1.9.8 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. It affects users with contributor or higher permissions. There is no information provided about t...

PT-2023-32454 · WordPress · Imagemapper

Name of the Vulnerable Software and Affected Versions: ImageMapper plugin for WordPress versions up to, and including, 1.2.6 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on multiple functions. This allows unauthenticated attackers to...

PT-2023-32282 · WordPress · Wd Widgettwitter

Name of the Vulnerable Software and Affected Versions: WD WidgetTwitter plugin for WordPress versions up to, and including, 1.0.9 Description: The issue arises from insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the plugin's...

CVE-2023-5360

The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE. Recent assessments: jheysel-r7 at November 29, 2023 9:40pm UTC reported: The Royal...

PT-2023-29895 · Unknown · Eric Teubert Archivist – Custom Archive Templates

Name of the Vulnerable Software and Affected Versions: Eric Teubert Archivist – Custom Archive Templates plugin versions 1.7.5 and earlier Description: The issue is an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into a website...

PT-2023-29832 · Lavacode · Lavacode Lava Directory Manager

Name of the Vulnerable Software and Affected Versions: Lavacode Lava Directory Manager plugin versions = 1.1.34 Description: The issue is related to an Unauth. Stored Cross-Site Scripting XSS vulnerability. This allows for the storage of malicious scripts that can be executed by other users,...

PT-2023-29720 · Unknown · Leadsquared Suite

Name of the Vulnerable Software and Affected Versions: LeadSquared Suite plugin versions 0.7.4 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects authenticated administrators. This vulnerability allows for malicious scripts to be stored o...

PT-2023-29879 · Unknown · Awesome Togi Product Category Tree

Name of the Vulnerable Software and Affected Versions: AWESOME TOGI Product Category Tree plugin versions = 2.5 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application that the user ...

PT-2023-29719 · WordPress · Martin Gibson Wp Gotowebinar

Name of the Vulnerable Software and Affected Versions: Martin Gibson WP GoToWebinar plugin versions = 14.45 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin or higher privileges can inject malicious scripts...

PT-2023-29894 · Internet Marketing Ninjas · Internal Link Building Plugin

Name of the Vulnerable Software and Affected Versions: Internet Marketing Ninjas Internal Link Building plugin versions = 1.2.3 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing...

PT-2023-29845 · WordPress · Chetan Gole Smooth Scroll Links

Name of the Vulnerable Software and Affected Versions: Chetan Gole Smooth Scroll Links SSL plugin versions = 1.1.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application that the us...

PT-2023-29723 · Unknown · Xydac Ultimate Taxonomy Manager

Name of the Vulnerable Software and Affected Versions: XYDAC Ultimate Taxonomy Manager plugin versions = 2.0 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This means an attacker could potentially trick a user into performing unintended actions on a web...

PT-2023-29478 · Sendpulse · Sendpulse Free Web Push Plugin

Name of the Vulnerable Software and Affected Versions: SendPulse Free Web Push plugin versions = 1.3.1 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...

SB Child List <= 4.5 - Settings Update via CSRF

Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...