PT-2024-14926 · WordPress · Ecwid Ecommerce Shopping Cart

Name of the Vulnerable Software and Affected Versions: Ecwid Ecommerce Shopping Cart WordPress plugin versions prior to 6.12.5 Description: The issue is related to the lack of a CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack...

CVE-2023-51949

Verydows v2.0 was discovered to contain a Cross-Site Request Forgery CSRF via the component /protected/controller/backend/rolecontroller...

PT-2024-14335 · Verydows · Verydows

Name of the Vulnerable Software and Affected Versions: Verydows version 2.0 Description: The issue is related to a Cross-Site Request Forgery CSRF in the /protected/controller/backend/role controller component. This allows for unauthorized actions to be performed on behalf of a user without their...

CVE-2023-6242

The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4 for Pro & 2.2.7 for Free. This is due to missing or incorrect nonce validation on the evoeventpostupdatemeta function. This makes it...

CVE-2023-4246

The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. This is due to missing or incorrect nonce validation on the givesendwpremoteinstallhandler function. This makes it possible for unauthenticated attackers to install and activate t...

CVE-2023-50931

An issue was discovered in savignano S/Notify before 2.0.1 for Bitbucket. While an administrative user is logged on, the configuration settings of S/Notify can be modified via a CSRF attack. The injection could be initiated by the administrator clicking a malicious link in an email or by visiting...

savignano S/Notify Security Vulnerabilities

savignano S/Notify is savignano's most versatile email encryption solution for Jira, Confluence and Bitbucket. A security vulnerability exists in savignano S/Notify versions prior to 2.0.1 that originates from a configuration setting that can be modified via a cross-site request forgery CSRF...

Cross site request forgery (csrf)

FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery CSRF via the component /system/site/configfooterupdagte...

CVE-2023-6845

The CommentTweets WordPress plugin through 0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

CVE-2023-6529

The WP VR WordPress plugin before 8.3.15 does not authorisation and CSRF in a function hooked to admininit, allowing unauthenticated users to downgrade the plugin, thus leading to Reflected or Stored XSS, as previous versions have such vulnerabilities...

PT-2024-15109 · WordPress · Commenttweets

Name of the Vulnerable Software and Affected Versions: CommentTweets WordPress plugin versions 0.6 and earlier Description: The issue concerns the lack of CSRF checks in certain areas of the plugin, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks...

CVE-2023-52121

Cross-Site Request Forgery CSRF vulnerability in NitroPack Inc. NitroPack – Cache & Speed Optimization for Core Web Vitals, Defer CSS & JavaScript, Lazy load Images.This issue affects NitroPack – Cache & Speed Optimization for Core Web Vitals, Defer CSS & JavaScript, Lazy load Images: from n/a...

CVE-2023-51673

CVE-2023-51673 concerns Cross-Site Request Forgery in the Stylish Price List – Price Table Builder & QR Code Restaurant Menu WordPress plugin (affected: from n/a through 7.0.17). The issue is a CSRF flaw (no details on exploit path beyond CSRF) that could enable unauthorized actions by a logged-i...

CVE-2023-52129

Cross-Site Request Forgery CSRF vulnerability in Michael Winkler teachPress.This issue affects teachPress: from n/a through 9.0.4...

CVE-2023-52123 WordPress Strong Testimonials Plugin <= 3.1.10 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in WPChill Strong Testimonials.This issue affects Strong Testimonials: from n/a through 3.1.10...

CVE-2023-52128

CVE-2023-52128: CSRF vulnerability in White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard. Affected versions: from n/a through 2.9.0. The provided connected documents do not reveal exploit details, patch status, vectors, or remediation steps; technical specifics are not ...

CVE-2023-52130

CVE-2023-52130 concerns the WordPress plugin Affiliates Manager (

CVE-2023-52136

CVE-2023-52136 is a Cross-Site Request Forgery (CSRF) vulnerability in Smash Balloon Custom Twitter Feeds (also named Custom Twitter Feeds – A Tweets Widget or X Feed Widget). Affected: Custom Twitter Feeds plugin for WordPress, up to version 2.1.2. The related Wordfence entry confirms CSRF expos...

CVE-2023-52150

Technical details for CVE-2023-52150 are not publicly available in the provided Connected Documents. Monitor for updates.

PT-2024-14425 · WordPress · White Label – Wordpress Custom Admin

Name of the Vulnerable Software and Affected Versions: White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard versions 2.9.0 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user...