CVE-2024-10862

The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to SQL Injection via the 'searchparams' parameter in all versions up to, and including, 8.7.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

CVE-2024-10862 NEX-Forms <= 8.7.13 - Authenticated (Admin+) SQL Injection

The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to SQL Injection via the 'searchparams' parameter in all versions up to, and including, 8.7.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

CVE-2024-10862 NEX-Forms <= 8.7.15 - Authenticated (Admin+) SQL Injection

The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to SQL Injection via the 'searchparams' parameter in all versions up to, and including, 8.7.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

CVE-2024-11607

The GTPayment Donations WordPress plugin through 1.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-11607 GTPayment Donations <= 1.0.0 - Stored XSS via CSRF

The GTPayment Donations WordPress plugin through 1.0.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-56140 Bypass of CSRF Middleware in Astro

Astro is a web framework for content-driven websites. In affected versions a bug in Astro’s CSRF-protection middleware allows requests to bypass CSRF checks. When the security.checkOrigin configuration option is set to true, Astro middleware will perform a CSRF check. However, a vulnerability...

CVE-2024-56140 Bypass of CSRF Middleware in Astro

Astro is a web framework for content-driven websites. In affected versions a bug in Astro’s CSRF-protection middleware allows requests to bypass CSRF checks. When the security.checkOrigin configuration option is set to true, Astro middleware will perform a CSRF check. However, a vulnerability...

WordPress Cost Calculator Builder plugin < 3.2.43 - Settings update via CSRF vulnerability

Settings update via CSRF vulnerability discovered by Miguel Xavier Penha Neto in WordPress Plugin Cost Calculator Builder versions 3.2.43...

CVE-2024-10892

The Cost Calculator Builder WordPress plugin before 3.2.43 does not have CSRF checks in some AJAX actions, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

CVE-2024-56017

Cross-Site Request Forgery CSRF vulnerability in Tom Royal Stop Registration Spam allows Stored XSS.This issue affects Stop Registration Spam: from n/a through 1.23...

CVE-2024-56017

CVE-2024-56017 affects the WordPress Stop Registration Spam plugin (versions

WordPress Stop Registration Spam Plugin <= 1.23 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by 0xd4rk5id3 Patchstack Alliance in WordPress Plugin Stop Registration Spam versions = 1.23...

CVE-2024-54421

Cross-Site Request Forgery CSRF vulnerability in SanjayNegi Floating Video Player floating-player allows Stored XSS.This issue affects Floating Video Player: from n/a through = 1.0...

CVE-2024-54405

Cross-Site Request Forgery CSRF vulnerability in etemplates ECT Social Share ect-social-share allows Stored XSS.This issue affects ECT Social Share: from n/a through = 1.3...

CVE-2024-54399

Cross-Site Request Forgery CSRF vulnerability in CRUDLab CRUDLab Google Plus Button crudlab-google-plus allows Stored XSS.This issue affects CRUDLab Google Plus Button: from n/a through = 1.0.2...

CVE-2024-54396

Cross-Site Request Forgery CSRF vulnerability in elmervillanueva Bet sport Free bet-sport-free allows Cross Site Request Forgery.This issue affects Bet sport Free: from n/a through = 1.0.0...

CVE-2024-54331

Cross-Site Request Forgery CSRF vulnerability in Micha I Plant A Tree i-plant-a-tree allows Stored XSS.This issue affects I Plant A Tree: from n/a through = 1.7.3...

CVE-2024-56015

CVE-2024-56015 concerns a CSRF vulnerability in the Tidy Up WordPress plugin by John Godley that enables a reflected XSS. Public details in the connected Red Hat entry describe the issue as a CSRF vulnerability that allows reflected XSS, affecting versions from unknown public release up to 1.3. T...

CVE-2024-54368 WordPress GitSync plugin <= 1.1.0 - CSRF to Remote Code Execution vulnerability

Cross-Site Request Forgery CSRF vulnerability in rubengarzajr GitSync git-sync allows Code Injection.This issue affects GitSync: from n/a through = 1.1.0...

CVE-2024-54395 WordPress Increase Sociability plugin <= 1.3.0 - Reflected Cross Site Request Forgery (CSRF) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in preblogging Increase Sociability increase-sociability allows Reflected XSS.This issue affects Increase Sociability: from n/a through = 1.3.0...