CVE-2024-1109: Missing Authorization

The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the initdownload and init functions in all versions up to, and including, 4.0.11. This makes it possible for unauthenticated attackers to export the plugin's tracki...

PT-2024-16761 · WordPress · Podlove Podcast Publisher

Name of the Vulnerable Software and Affected Versions: Podlove Podcast Publisher plugin for WordPress versions up to, and including, 4.0.11 Description: The issue is related to a missing capability check on the init function, which allows unauthorized modification of data. This makes it possible...

CVE-2024-1118: Improper Neutralization of Special Elements used in an SQL Command

The Podlove Subscribe button plugin for WordPress is vulnerable to UNION-based SQL Injection via the 'button' attribute of the podlove-subscribe-button shortcode in all versions up to, and including, 1.3.10 due to insufficient escaping on the user supplied parameter and lack of sufficient...

WordPress Podlove Subscribe button Plugin <= 1.3.10 is vulnerable to SQL Injection

Software Podlove Subscribe button Type Plugin Vulnerable versions = 1.3.10 Fixed in 1.3.11 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-1118 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID fcca748172f2 Credits Lucio Sá Required privilege Contributor...

PT-2024-16803

Name of the Vulnerable Software and Affected Versions Podlove Subscribe button plugin for WordPress versions up to, and including, 1.3.10 Description The issue is related to a UNION-based SQL Injection vulnerability via the button attribute of the podlove-subscribe-button shortcode. This...

Podlove Podcast Publisher < 4.0.12 - Missing Authorization to Settings Import

Description The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the init function in all versions up to, and including, 4.0.11. This makes it possible for unauthenticated attackers to import the plugin's settin...

Podlove Subscribe button < 1.3.11 - Authenticated (Contributor+) SQL Injection

Description The Podlove Subscribe button plugin for WordPress is vulnerable to UNION-based SQL Injection via the 'button' attribute of the podlove-subscribe-button shortcode in all versions up to, and including, 1.3.10 due to insufficient escaping on the user supplied parameter and lack of...

Podlove Web Player <= 5.7.3 - Missing Authorization

Description The Podlove Web Player plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on an unknown function in versions up to, and including, 5.7.3. This makes it possible for unauthenticated attackers to perform an unauthorized action...

PT-2023-8830 · WordPress · Podlove Web Player

Name of the Vulnerable Software and Affected Versions: Podlove Web Player versions through 5.7.3 Description: The issue is related to insufficient authorization procedures in the Podlove Web Player plugin for WordPress, allowing a remote attacker to impact the integrity and confidentiality of...

CVE-2023-25481

Cross-Site Request Forgery CSRF vulnerability in Podlove Podlove Subscribe button plugin = 1.3.7 versions...

CVE-2023-25472

Cross-Site Request Forgery CSRF vulnerability in Podlove Podlove Podcast Publisher plugin = 3.8.3 versions...

CVE-2023-25481

Cross-Site Request Forgery CSRF vulnerability in Podlove Podlove Subscribe button plugin = 1.3.7 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Podlove Podlove Podcast Publisher plugin = 3.8.3 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Podlove Podlove Subscribe button plugin = 1.3.7 versions...

CVE-2023-25481

CVE-2023-25481 affects the Podlove Podlove Subscribe Button plugin for WordPress, with CSRF vulnerabilities in versions

CVE-2023-25481 WordPress Podlove Subscribe button Plugin <= 1.3.7 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Podlove Podlove Subscribe button plugin = 1.3.7 versions...

CVE-2023-25481

Cross-Site Request Forgery CSRF vulnerability in Podlove Podlove Subscribe button plugin = 1.3.7 versions...

CVE-2023-25481 WordPress Podlove Subscribe button Plugin <= 1.3.7 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Podlove Podlove Subscribe button plugin = 1.3.7 versions...

CVE-2023-25472 WordPress Podlove Podcast Publisher Plugin <= 3.8.3 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Podlove Podlove Podcast Publisher plugin = 3.8.3 versions...

CVE-2023-25472 WordPress Podlove Podcast Publisher Plugin <= 3.8.3 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Podlove Podlove Podcast Publisher plugin = 3.8.3 versions...