CVE-2021-24989 Accept Donations with PayPal < 1.3.4 - Arbitrary Post Deletion via CSRF

The Accept Donations with PayPal WordPress plugin before 1.3.4 does not have CSRF check in place and does not ensure that the post to be deleted belongs to the plugin, allowing attackers to make a logged in admin delete arbitrary posts from the blog...

WordPress plugin跨站请求伪造漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. cross-site request forgery vulnerability exists in versions of the Accept Donations with PayPal plug...

WordPress plugin 跨站脚本漏洞

WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language. The platform supports setting up personal blogging sites on servers with PHP and MySQL. cross-site request forgery vulnerability exists in versions prior to 11.0.7 of the Product Feed PRO for...

NextScripts: Social Networks Auto-Poster < 4.3.25 - Arbitrary Post Deletion via CSRF

The plugin does not have CSRF check in place when deleting items, allowing attacker to make a logged in admin delete arbitrary posts via a CSRF attack https://example.com/wp-admin/admin.php?page=nxssnap-reposter&item=1&action=delete...

NextScripts: Social Networks Auto-Poster < 4.3.25 - Arbitrary Post Deletion via CSRF

The plugin does not have CSRF check in place when deleting items, allowing attacker to make a logged in admin delete arbitrary posts via a CSRF attack PoC https://example.com/wp-admin/admin.php?page=nxssnap-reposter=1=delete...

Qubely < 1.7.8 - Subscriber+ Arbitrary Post Deletion

The plugin does not have authorisation and CSRF check on the qubelydeletesavedblock AJAX action, and does not ensure that the block to be deleted belong to the plugin, as a result, any authenticated users, such as subscriber can delete arbitrary posts Note: v1.7.7 added capability check, CSRF che...

Qubely < 1.7.8 - Subscriber+ Arbitrary Post Deletion

The plugin does not have authorisation and CSRF check on the qubelydeletesavedblock AJAX action, and does not ensure that the block to be deleted belong to the plugin, as a result, any authenticated users, such as subscriber can delete arbitrary posts Note: v1.7.7 added capability check, CSRF che...

CVE-2021-24780

The Single Post Exporter WordPress plugin through 1.1.1 does not have CSRF checks when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and give access to the export feature to any role such as subscriber. Subscriber users would then be able...

Cross site request forgery (csrf)

The Single Post Exporter WordPress plugin through 1.1.1 does not have CSRF checks when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and give access to the export feature to any role such as subscriber. Subscriber users would then be able...

CVE-2021-24780 Single Post Exporter <= 1.1.1 - Plugin's Settings Update via CSRF

The Single Post Exporter WordPress plugin through 1.1.1 does not have CSRF checks when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and give access to the export feature to any role such as subscriber. Subscriber users would then be able...

Accept Donations with PayPal < 1.3.4 - Arbitrary Post Deletion via CSRF

The plugin does not have CSRF check in place and does not ensure that the post to be deleted belongs to the plugin, allowing attackers to make a logged in admin delete arbitrary posts from the blog PoC https://examle.com/wp-admin/admin.php?page=wpedonmenu=delete&action2;=delete=1...

WP Google Map < 1.8.1 - Subscriber+ Arbitrary Post Deletion and Plugin's Settings Update

The plugin does not have proper authorisation and CSRF in most of its AJAX actions, which could allow any authenticated users, such as subscriber to delete arbitrary posts and update the plugin's settings. v1.8.1 added authorisation checks, however CSRF was still missing and a separate advisory h...

GitLab: Arbitrary POST request as victim user from HTML injection in Jupyter notebooks

Summary An attacker can create a Jupyter notebook that will make arbitrary POST requests as the victim user. In the "worst case" an attacker could make an admin create a new admin account for the attacker. Other possible attack vectors are forcing invites to private projects etc. Every POST reque...

WP DSGVO Tools (GDPR) Plugin for WordPress < 3.1.24 Arbitrary Post Deletion

The WordPress WP DSGVO Tools GDPR Plugin installed on the remote host is affected by an unauthenticated arbitrary post deletion vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source data...

Single Post Exporter <= 1.1.1 - Plugin's Settings Update via CSRF

The plugin does not have CSRF checks when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and give access to the export feature to any role such as subscriber. Subscriber users would then be able to export an arbitrary post/page such as...

WordPress Get Custom Field Values plugin <= 3.9.4 - Arbitrary Post Metadata Access vulnerability

Arbitrary Post Metadata Access vulnerability discovered by Francesco Carlucci in WordPress Get Custom Field Values plugin versions = 3.9.4. Solution Update the WordPress Get Custom Field Values plugin to the latest available version at least 4.0...

Get Custom Field Values < 4.0 - Contributors+ Arbitrary Post Metadata Access

The plugin allows users with a role as low as Contributor to access other posts metadata without validating the permissions. Eg. contributors can access admin posts metadata. PoC customfield field="fieldname" postid="ID" e.g customfield field="ctctverifykey" postid="23"...

CVE-2021-24783

The issue concerns the WordPress plugin Post Expirator. Versions before 2.6.0 expose a vulnerability where improper capability checks allow users with as low as Contributor role to schedule deletion of arbitrary posts. This is documented across multiple sources (NVD/CVE entry CVE-2021-24783 and R...

CVE-2021-42359 WP DSGVO Tools (GDPR) <= 3.1.23 Unauthenticated Arbitrary Post Deletion

WP DSGVO Tools GDPR = 3.1.23 had an AJAX action, ‘admin-dismiss-unsubscribe‘, which lacked a capability check and a nonce check and was available to unauthenticated users, and did not check the post type when deleting unsubscription requests. As such, it was possible for an attacker to permanentl...

WP DSGVO Tools (GDPR) < 3.1.24 - Unauthenticated Arbitrary Post Deletion

The ‘admin-dismiss-unsubscribe‘ AJAX action in WP DSGVO Tools GDPR = 3.1.23 lacked a capability check and a nonce check and was available to unauthenticated users, and did not check the post type when deleting unsubscription requests. As such, it was possible for an attacker to permanently delete...