CVE-2021-24536

The Custom Login Redirect WordPress plugin through 1.0.0 does not have CSRF check in place when saving its settings, and do not sanitise or escape user input before outputting them back in the page, leading to a Stored Cross-Site Scripting issue...

CVE-2021-24410

The తెలుగు బైబిల్ వచనములు WordPress plugin through 1.0 is lacking any CSRF check when saving its settings and verses, and do not sanitise or escape them when outputting them back in the page. This could allow attackers to make a logged in admin change the settings, as well as add malicious verses...

CVE-2021-24543

The jQuery Reply to Comment WordPress plugin through 1.31 does not have any CSRF check when saving its settings, nor sanitise or escape its 'Quote String' and 'Reply String' settings before outputting them in Comments, leading to a Stored Cross-Site Scripting issue...

CVE-2024-6712

The MapFig Studio WordPress plugin through 0.2.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-6712

The MapFig Studio WordPress plugin through 0.2.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

PT-2025-21426 · Unknown · Wordpress连接微博

Name of the Vulnerable Software and Affected Versions: WordPress连接微博 WordPress plugin versions 2.5.6 and earlier Description: The issue concerns a lack of CSRF check in some areas of the plugin, as well as missing sanitization and escaping. This could allow attackers to make logged-in admins add...

PT-2025-21505 · WordPress · The Joy Of Text Lite

Name of the Vulnerable Software and Affected Versions: The Joy Of Text Lite WordPress plugin versions 2.3.1 and earlier Description: The issue is related to the lack of a CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack...

CVE-2024-6857

CVE-2024-6857 concerns the WP MultiTasking WordPress plugin (versions <= 0.1.12) where updating Header/Footer/Body Script Settings lacks CSRF protection. Exploitation could allow an attacker to force logged-in admins to perform these updates via CSRF. Public sources in connected docs confirm t...

PT-2025-11155 · WordPress · Limit Bio Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Limit Bio WordPress plugin versions 1.0 and earlier Description: The issue concerns a lack of CSRF check when updating settings in the Limit Bio WordPress plugin, along with missing sanitization and escaping. This could allow attackers to mak...

CVE-2025-0522

The LikeBot WordPress plugin through 0.85 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

PT-2024-16625 · WordPress · Cost Calculator Builder

Name of the Vulnerable Software and Affected Versions: Cost Calculator Builder WordPress plugin versions prior to 3.2.43 Description: The issue is related to a missing CSRF check in some AJAX actions of the Cost Calculator Builder WordPress plugin. This could allow attackers to make logged-in use...

CVE-2023-7273 Cross Site Request Forgery in Kiteworks OwnCloud

Cross site request forgery in Kiteworks OwnCloud allows an unauthenticated attacker to forge requests. If a request has no Authorization header, it is created with an empty string as value by a rewrite rule. The CSRF check is done by comparing the header value to null, meaning that the existing...

CVE-2023-7273 Cross Site Request Forgery in Kiteworks OwnCloud

Cross site request forgery in Kiteworks OwnCloud allows an unauthenticated attacker to forge requests. If a request has no Authorization header, it is created with an empty string as value by a rewrite rule. The CSRF check is done by comparing the header value to null, meaning that the existing...

CVE-2024-8051 Special Feed Items <= 1.0.1 - Stored XSS via CSRF

The Special Feed Items WordPress plugin through 1.0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-7689 Snapshot Backup <= 2.1.1 - Stored XSS via CSRF

The Snapshot Backup WordPress plugin through 2.1.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-6855

The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating exit popups, which could allow attackers to make logged admins perform such action via a CSRF attack...

PT-2024-34814

Name of the Vulnerable Software and Affected Versions: CM Email Registration Blacklist and Whitelist WordPress plugin versions prior to 1.4.9 Description: The issue allows attackers to perform actions on the blacklist or whitelist menu without the admin's knowledge or consent, potentially leading...

CVE-2024-5155

CVE-2024-5155 affects the Inquiry cart WordPress plugin (

CVE-2024-3823

CVE-2024-3823 affects the WordPress plugin Base64 Encoder/Decoder (versions ≤ 0.9.2). The underlying issue is lack of CSRF protection when updating settings, combined with insufficient sanitization and escaping. This could allow a logged-in attacker to trigger a CSRF that enables Stored XSS paylo...

PT-2024-25667 · WordPress · Wp Prayer

Name of the Vulnerable Software and Affected Versions: WP Prayer WordPress plugin versions 2.0.9 and earlier Description: The issue is related to the lack of a CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. Recommendations:...