1254 matches found
WP Prayer < 1.6.7 - Arbitrary Plugin Settings Update via CSRF
The plugin did not properly check for CSRF in some of its module functions, allowing attacker to make logged in admin change all plugin's settings including the email settings for example. v1.6.6 fixed most of CSRF checks, but the one in model.emailsettings.php was improperly fixed bypass still...
WordPress Ship To eCourier plugin <= 1.0.1 - Cross-Site Request Forgery (CSRF) vulnerability allowing Plugin Settings Update
Cross-Site Request Forgery CSRF vulnerability allowing Plugin Settings Update discovered by WPScan Team in WordPress Ship To eCourier plugin versions = 1.0.1. Solution Update the WordPress Ship To eCourier plugin to the latest available version at least 1.0.2...
Parcel Tracker eCourier < 1.0.2 - Plugin's Settings Update via CSRF
The plugin did not properly check for CSRF, allowing attackers to make a logged in administrator update the plugin's settings...
CVE-2021-24162 Responsive Menu < 4.0.4 - CSRF to Settings Update
In the Reponsive Menu free and Pro WordPress plugins before 4.0.4, attackers could craft a request and trick an administrator into importing all new settings. These settings could be modified to include malicious JavaScript, therefore allowing an attacker to inject payloads that could aid in...
Citrix App Layering: Mass Edit of VMX Advanced Settings
Introduction Sometimes there are special settings that Unidesk customers must add to their desktop VMX files based on recommendations by VMware. This script was developed in order to ease the administrative burden of this requirement. The script can also set memory or CPU reservations, as these a...
The Official WordPress Facebook Chat Plugin < 1.6 - Authenticated Options Change to Chat Takeover
This flaw made it possible for low-level authenticated attackers to connect their own Facebook Messenger account to any site running the vulnerable plugin and engage in chats with site visitors on affected sites. Obtain PageID from a test Facebook Page found under page - about - pageID. Use this...
WP GDPR <= 2.1.1 - Multiple Unauthenticated Issues
The plugin is affected by multiple issues, and has been closed from WP repo: - Unauthenticated Stored XSS - Unauthenticated Content spoofing - Unauthenticated Arbitrary comment deletion - Unauthenticated plugin's settings update...
WordPress Advanced AJAX Product Filters plugin <= 1.3.6.1 - Unauthenticated Plugin Settings Update vulnerability
Unauthenticated Plugin Settings Update vulnerability found in WordPress Advanced AJAX Product Filters plugin versions = 1.3.6.1. Solution Update the WordPress Advanced AJAX Product Filters plugin to the latest available version at least 1.3.7...
Advanced AJAX Product Filters < 1.3.7 - Unauthenticated Plugin Settings Update
The Advanced AJAX Product Filters WordPress plugin was affected by an Unauthenticated Plugin Settings Update security vulnerability...
Fedora Update for kde-settings FEDORA-2019-a746ac9c89
The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
WordPress WP Custom Body Class plugin <= 0.7.0 - Cross-Site Request Forgery (CSRF) > Stored Cross-Site Scripting (XSS) + Settings Update vulnerabilities
Cross-Site Request Forgery CSRF Stored Cross-Site Scripting XSS + Settings Update vulnerabilities found in WordPress WP Custom Body Class plugin versions = 0.7.0. Solution Update the WordPress WP Custom Body Class plugin to the latest available version at least 0.7.1...
WP Custom Body Class <= 0.7.0 - CSRF to Stored XSS and Settings Update
Lack of CSRF check and sanitisation when updating the plugin's settings could lead to unauthorised settings update as well as stored XSS issues XSS fixed in 0.7.0. CSRF still there - vendor contacted CSRF fixed in 0.7.1 /wp-admin/options-general.php?page=custombodyclass" method="POST" ' /...
WP Custom Body Class <= 0.7.0 - CSRF to Stored XSS and Settings Update
Lack of CSRF check and sanitisation when updating the plugin's settings could lead to unauthorised settings update as well as stored XSS issues XSS fixed in 0.7.0. CSRF still there - vendor contacted CSRF fixed in 0.7.1 PoC...
Block WP Login <= 1.3.0 - CSRF and Unauthorised Settings Update
Lack of CSRF and authorisation checks in the bwplconfigureslug function registered as an admininit action could allow attacker via CSRF, or unauthenticated using the admin-ajax.php to change the plugin settings located at /wp-admin/options-permalink.php and disable the protection offered. v1.3.1...
Social Warfare <= 3.5.2 - Unauthenticated Arbitrary Settings Update
Malicious eval is being inserted into the wpoptions table, in the optionname: socialwafaresettings, in the Twitter field. When the plugin is active, it causes the site to issue a JavaScript redirect to porn sites. Deactivating the plugin disables the redirect, but the malicious eval is still in t...
CVE-2018-18416
LANGO Codeigniter Multilingual Script 1.0 has XSS in the input and upload sections, as demonstrated by the sitename parameter to the admin/settings/update URI...
CVE-2018-18416
LANGO Codeigniter Multilingual Script 1.0 has XSS in the input and upload sections, as demonstrated by the sitename parameter to the admin/settings/update URI...
CVE-2018-17070
An issue was discovered in UNL-CMS 7.59. A CSRF attack can update the website settings via ?q=admin%2Fconfig%2Fsystem%2Fsite-information&render=overlay&render=overlay...
