11783 matches found
CVE-2023-1342
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on the ucssconnect function. This makes it possible for unauthenticated attackers to connect the si...
CVE-2023-1336
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized settings update due to a missing capability check on the ajaxdeactivate function in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers with subscriber-level access to...
CVE-2023-1341
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on the ajaxdeactivate function. This makes it possible for unauthenticated attackers to turn off...
CVE-2023-36518
Missing Authorization vulnerability in Hugh Lashbrooke Post Hit Counter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Hit Counter: from n/a through 1.3.2...
CVE-2023-27436
Cross-Site Request Forgery CSRF vulnerability in Louis Reingold Elegant Custom Fonts plugin = 1.0 versions...
CVE-2023-27608
Missing Authorization vulnerability in WP Swings Points and Rewards for WooCommerce.This issue affects Points and Rewards for WooCommerce: from n/a through 1.5.0...
CVE-2023-27415
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Themeqx LetterPress plugin = 1.1.2 versions...
CVE-2023-51532
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Icegram Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building allows Stored XSS.This issue affects Icegram Engage – WordPress Lead Generation, Popup Builder...
CVE-2023-1340
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on the clearuucsslogs function. This makes it possible for unauthenticated attackers to clear plugi...
CVE-2023-51407
Cross-Site Request Forgery CSRF vulnerability in Rocket Elements Split Test For Elementor.This issue affects Split Test For Elementor: from n/a through 1.6.9...
CVE-2023-33313
Cross-Site Request Forgery CSRF vulnerability in ThemeinProgress WIP Custom Login plugin = 1.2.9 versions...
CVE-2023-47785
Cross-Site Request Forgery CSRF vulnerability in LayerSlider plugin = 7.7.9 versions...
CVE-2023-47505
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Elementor.Com Elementor allows Cross-Site Scripting XSS.This issue affects Elementor: from n/a through 3.16.4...
CVE-2023-47828
Missing Authorization vulnerability in Mandrill wpMandrill.This issue affects wpMandrill: from n/a through 1.33...
CVE-2023-46626
Unauth. Reflected Cross-Site Scripting XSS vulnerability in FLOWFACT WP Connector plugin = 2.1.7 versions...
CVE-2022-43480
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Magneticlab Sàrl Homepage Pop-up plugin = 1.2.5 versions...
CVE-2022-45076
Cross-Site Request Forgery CSRF vulnerability in WebMat Flexible Elementor Panel plugin = 2.3.8 versions...
CVE-2022-46594
TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the updatefilename parameter in the autoupfw sub420A04 function...
PT-2025-22713 · Nasa Core · Nasa Core
Name of the Vulnerable Software and Affected Versions: Nasa Core versions through 6.3.2 Description: The issue affects Nasa Core due to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', allowing PHP Local File Inclusion...