CVE-2022-0424

The CVE-2022-0424 issue affects the Popup by Supsystic WordPress plugin, specifically versions prior to 1.10.9. The root cause is missing authentication/authorization in an AJAX action, permitting unauthenticated attackers to invoke the endpoint and retrieve the email addresses of subscribed user...

Cross site request forgery (csrf)

The Coming soon and Maintenance mode WordPress plugin before 3.6.8 does not have CSRF check in its comingsoonsendmail AJAX action, allowing attackers to make logged in admin to send arbitrary emails to all subscribed users via a CSRF attack...

Coming soon and Maintenance mode < 3.6.8 - Arbitrary Email Sending to Subscribed Users via CSRF

The plugin does not have CSRF check in its comingsoonsendmail AJAX action, allowing attackers to make logged in admin to send arbitrary emails to all subscribed users via a CSRF attack fetch"https://example.com/wp-admin/admin-ajax.php", "headers": "content-type":...

Cross-site Scripting (XSS)

mailman is vulnerable to cross-site scripting XSS. The vulnerability exists as multiple input sanitization flaws were found in the way Mailman displayed usernames of subscribed users on certain pages. If a user who is subscribed to a mailing list were able to trick a victim into visiting one of...

Mail.ru: Information Disclosure [ https://curious.ru/api/submissions ]

API endpoint at curious.ru disclosed e-mails of subscribed users...

WordPress WP Maintenance Mode Plugin Information Disclosure Vulnerability

WordPress is the WordPress Software Foundation of a set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site.WP Maintenance Mode Plugin is used in one of the site maintenance page settings plugin. An information disclosu...