CVE-2025-23749 WordPress mybb Last Topics plugin <= 1.0 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in progpars.net mybb Last Topics mybb-last-topics allows Stored XSS.This issue affects mybb Last Topics: from n/a through = 1.0...

CVE-2024-12008

The W3 Total Cache plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.8.1 through the publicly exposed debug log file. This makes it possible for unauthenticated attackers to view potentially sensitive information in the exposed log file. For exampl...

CVE-2025-22963

Teedy through 1.11 allows CSRF for account takeover via POST /api/user/admin...

CVE-2024-51700

CVE-2024-51700 is a cross-site request forgery to stored cross-site scripting vulnerability affecting NAVER Analytics (versions up to 0.9, has been unpatched per ENISA/EUVD entry). Connected EUVD-2024-45791 notes malicious code in NAVER Analytics (PyPI bioql unrelated to NAVER) but reiterates NAV...

CVE-2024-11842

The DN Shipping by Weight for WooCommerce WordPress plugin before 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-11842

The CVE-2024-11842 entry concerns the DN Shipping by Weight for WooCommerce WordPress plugin prior to version 1.2. The root cause is a missing CSRF check when updating plugin settings, enabling a CSRF attack to modify settings by a logged-in administrator. Impact described: settings changes could...

CVE-2024-11842 DN Shipping by Weight for WooCommerce < 1.2 - Settings Update via CSRF

The DN Shipping by Weight for WooCommerce WordPress plugin before 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-56310

REDCap through 14.9.6 has a security flaw in the Project Dashboards name, exposing users to a Cross-Site Request Forgery CSRF attack. An attacker can exploit this by luring users into clicking on a Project Dashboards name that contains the malicious payload, which triggers a logout request and...

PT-2024-36782 · Redcap · Redcap

Name of the Vulnerable Software and Affected Versions: REDCap versions 14.9.6 through 15.0.0 Description: The issue is related to a security flaw in the Notes section of calendar events in REDCap, exposing users to a Cross-Site Request Forgery CSRF attack. An attacker can exploit this by luring...

CVE-2024-11607

CVE-2024-11607 affects the WordPress plugin “GTPayment Donations” (versions up to 1.0.0). The vulnerability arises from missing CSRF checks in some areas and insufficient sanitisation/escaping, which could allow a logged-in administrator to inject a Stored XSS payload via a CSRF attack. Several c...

CVE-2024-54424

CVE-2024-54424 is a stored XSS in the WordPress plugin “Like in Vk.com.” The vulnerability arises from Improper Neutralization of Input During Web Page Generation, enabling stored cross-site scripting. Affected: Like in Vk.com from unspecified earliest version up to 0.5.2. The CVSSv3.1 base score...

CVE-2024-10480

The 3DPrint Lite WordPress plugin before 2.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-10480 3DPrint Lite < 2.1 - Settings Update via CSRF

The 3DPrint Lite WordPress plugin before 2.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-10480

CVE-2024-10480 affects the 3DPrint Lite WordPress plugin prior to 2.1. The issue is a missing CSRF check when updating plugin settings, enabling a logged-in attacker to change settings via CSRF. The Red Hat/NVD entries describe the same flaw and patch in version 2.1 or later. Impact is limited to...

PT-2024-16308 · WordPress · 3Dprint Lite

Name of the Vulnerable Software and Affected Versions: 3DPrint Lite WordPress plugin versions prior to 2.1 Description: The issue is related to a lack of CSRF check when updating settings in the 3DPrint Lite WordPress plugin. This could allow attackers to make a logged-in admin change settings vi...

CVE-2024-8157

The Alphabetical List WordPress plugin through 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-5029

The CM Table Of Contents WordPress plugin before 1.2.4 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-5030

The CM Table Of Contents WordPress plugin before 1.2.3 does not have CSRF check in place when resetting its settings, which could allow attackers to make a logged in admin perform such action via a CSRF attack...

CVE-2024-5030

The CVE-2024-5030 affects CM Table Of Contents – WordPress TOC Plugin up to version 1.2.3. It lacks CSRF protection when resetting settings, potentially allowing a logged-in attacker to perform a settings reset via CSRF. Red Hat and Patchstack confirm the issue and indicate the fix is in version ...

CVE-2024-51485

Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing fails to properly validate CSRF tokens when activating or deactivating plugins. This vulnerability allows an attacker to exploit CSRF attacks, potentially enabling them to change...