CVE-2024-3472

The Modal Window WordPress plugin before 5.3.10 does not have CSRF check in place when bulk deleting modals, which could allow attackers to make a logged in admin delete them via a CSRF attack...

CVE-2024-3476

The Side Menu Lite WordPress plugin before 4.2.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting buttons via CSRF attacks...

CVE-2024-3475

The Sticky Buttons WordPress plugin before 3.2.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting buttons via CSRF attacks...

CVE-2024-2405

The Float menu WordPress plugin before 6.0.1 does not have CSRF check in its bulk actions, which could allow attackers to make logged in admin delete arbitrary menu via a CSRF attack...

CVE-2024-3478

The CVE CVE-2024-3478 affects the WordPress plugin Herd Effects. It explains that the plugin, prior to version 5.2.7, lacks CSRF checks in certain bulk actions, enabling a logged-in attacker to coerce an admin into performing unintended actions (e.g., deleting effects) via CSRF attacks. Public so...

CVE-2024-3477

CVE-2024-3477 affects the Popup Box WordPress plugin pre-2.2.7. The vulnerability stems from missing CSRF checks in certain bulk actions, allowing an authenticated attacker to induce logged-in admins to perform unintended operations (e.g., deleting popups) via CSRF. The Red Hat and PatchStack ent...

CVE-2024-3471 Button Generator < 3.0 - Button Deletion via CSRF

The Button Generator WordPress plugin before 3.0 does not have CSRF check in place when bulk deleting, which could allow attackers to make a logged in admin delete buttons via a CSRF attack...

CVE-2024-2405 Float menu < 6.0.1 - Menu Deletion via CSRF

The Float menu WordPress plugin before 6.0.1 does not have CSRF check in its bulk actions, which could allow attackers to make logged in admin delete arbitrary menu via a CSRF attack...

CVE-2024-3474

CVE-2024-3474 concerns the WordPress plugin Wow Skype Buttons (versions before 4.0.4). The issue is a CSRF vulnerability in certain bulk actions that can let an authenticated, logged-in admin perform unauthorized operations, such as deleting buttons, via crafted requests. Public descriptions in R...

PT-2024-15863 · WordPress · 5280 Bootstrap Modal Contact Form

Name of the Vulnerable Software and Affected Versions: 5280 Bootstrap Modal Contact Form plugin for WordPress versions up to, and including, 1.0 Description: The issue is due to missing or incorrect nonce validation in class-sbmm-list-table.php, making it possible for unauthenticated attackers to...

PT-2024-26157 · WordPress · Sticky Buttons

Name of the Vulnerable Software and Affected Versions: The Sticky Buttons WordPress plugin versions prior to 3.2.4 Description: The issue is related to the lack of CSRF checks in some bulk actions, which could allow attackers to make logged-in admins perform unwanted actions, such as deleting...

PT-2024-26124 · WordPress · Button Generator

Name of the Vulnerable Software and Affected Versions: The Button Generator WordPress plugin versions prior to 3.0 Description: The issue is related to the lack of a CSRF check when bulk deleting, which could allow attackers to make a logged-in admin delete buttons via a CSRF attack...

PT-2024-26206 · WordPress · Counter Box

Name of the Vulnerable Software and Affected Versions: The Counter Box WordPress plugin versions prior to 1.2.4 Description: The issue is related to the lack of CSRF checks in some bulk actions, which could allow attackers to make logged-in admins perform unwanted actions, such as deleting counte...

kernel: drm/ttm: fix bulk_move corruption when adding a entry

In the Linux kernel, the following vulnerability has been resolved: drm/ttm: fix bulkmove corruption when adding a entry When the resource is the first in the bulkmove range, adding it again thus moving it to the tail will corrupt the list since the first pointer is not moved. This eventually lea...

WordPress 5280 Bootstrap Modal Contact Form plugin <= 1.0 - Cross-Site Request Forgery to Bulk Delete Messages vulnerability

Cross-Site Request Forgery to Bulk Delete Messages vulnerability discovered by Nathaniel Oh 0x4n3 in WordPress Plugin 5280 Bootstrap Modal Contact Form versions = 1.0...

CVE-2024-32542

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Organic Themes Bulk Block Converter allows Reflected XSS.This issue affects Bulk Block Converter: from n/a through 1.0.1...

CVE-2024-32542

CVE-2024-32542 affects Bulk Block Converter (WordPress). Root cause: improper input neutralization during web page generation, enabling reflected XSS. Affected versions: from n/a through 1.0.1. Remediation: patch status listed as Unpatched in the provided docs.

CVE-2024-32542 WordPress Bulk Block Converter plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Organic Themes Bulk Block Converter allows Reflected XSS.This issue affects Bulk Block Converter: from n/a through 1.0.1...

CVE-2024-32542 WordPress Bulk Block Converter plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Organic Themes Bulk Block Converter allows Reflected XSS.This issue affects Bulk Block Converter: from n/a through 1.0.1...

PT-2024-24662 · Organic Themes · Organic Themes Bulk Block Converter

Name of the Vulnerable Software and Affected Versions: Organic Themes Bulk Block Converter versions 1.0.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This means that an...