PT-2023-23459 · WordPress · Post Smtp Mailer

Name of the Vulnerable Software and Affected Versions: POST SMTP Mailer WordPress plugin versions prior to 2.5.7 Description: The issue concerns a lack of proper CSRF checks in some AJAX actions within the plugin. This could allow attackers to make logged-in users with the manage postman smtp...

PT-2023-18894 · WordPress · Caldera Forms Google Sheets Connector

Name of the Vulnerable Software and Affected Versions: Caldera Forms Google Sheets Connector WordPress plugin versions prior to 1.3 Description: The issue is related to the lack of a CSRF check when updating the Access Code in the Caldera Forms Google Sheets Connector WordPress plugin. This could...

PT-2023-25604 · WordPress · Woocommerce Shipping Multiple Addresses

Name of the Vulnerable Software and Affected Versions: WooCommerce Shipping Multiple Addresses plugin versions prior to 3.8.6 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing...

PT-2023-25145 · WordPress · Mycred

Name of the Vulnerable Software and Affected Versions: myCred plugin versions = 2.5 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application that the...

PT-2023-18888

Name of the Vulnerable Software and Affected Versions WooCommerce Google Sheet Connector WordPress plugin versions prior to 1.3.6 Description The issue concerns a lack of CSRF check when updating the Access Code, allowing attackers to potentially make logged-in admins change the access code to an...

PT-2023-26216 · WordPress · Faboba Falang Multilanguage

Name of the Vulnerable Software and Affected Versions: Faboba Falang multilanguage for WordPress plugin versions = 1.3.39 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application that...

PNP4Nagios 跨站请求伪造漏洞

PNP4Nagios is a plugin for the PNP4Nagios project. A cross-site request forgery vulnerability exists in PNP4Nagios version 0.6.26 and earlier, which stems from a lack of CSRF protection in the AJAX controller...

CVE-2023-32761

Cross Site Request Forgery CSRF vulnerability in Archer Platform before v.6.13 and fixed in v.6.12.0.6 and v.6.13.0 allows an authenticated attacker to execute arbitrary code via a crafted request...

CVE-2023-37598

A Cross Site Request Forgery CSRF vulnerability in issabel-pbx v.4.0.0-6 allows a remote attacker to cause a denial of service via the delete new virtual fax function...

Jenkins Test Results Aggregator Plugin vulnerable to Cross Site Request Forgery

Jenkins Test Results Aggregator Plugin 1.2.13 and earlier does not perform a permission check in an HTTP endpoint implementing form validation. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password. Additionally,...

Jenkins mabl Plugin missing permission check

Jenkins mabl Plugin 0.0.46 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in...

GHSA-M9JJ-P947-M8XV Jenkins mabl Plugin missing permission check

Jenkins mabl Plugin 0.0.46 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in...

Cross site request forgery (csrf)

A cross-site request forgery CSRF vulnerability in Jenkins Pipeline restFul API Plugin 0.11 and earlier allows attackers to connect to an attacker-specified URL, capturing a newly generated JCLI token...

CVE-2023-37954

A cross-site request forgery CSRF vulnerability in Jenkins Rebuilder Plugin 320.v5a0933ae7d61 and earlier allows attackers to rebuild a previous build...

CVE-2021-4427

The Vuukle Comments, Reactions, Share Bar, Revenue plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.31. This is due to missing or incorrect nonce validation in the /admin/partials/free-comments-for-wordpress-vuukle-admin-display.php file. This...

CVE-2023-2517

The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3.2. This is due to missing or incorrect nonce validation on the permalinksetup function. This makes it possible for unauthenticated attackers to change...

CVE-2023-3011 ARMember <= 4.0.5 - Cross-Site Request Forgery

The ARMember plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.0.5. This is due to missing or incorrect nonce validation on the armcheckusercap function. This makes it possible for unauthenticated attackers to perform multiple unauthorized action...

CVE-2021-4414

The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.8.5. This is due to missing or incorrect nonce validation on the wcalpreviewemails function. This makes it possible for unauthenticated attackers to generat...

CVE-2021-4409

The WooCommerce Etsy Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3.1. This is due to missing or incorrect nonce validation on the etcpfdeletefeed function. This makes it possible for unauthenticated attackers to delete an export...

CVE-2021-4415 Sunshine Photo Cart <= 2.8.28 - Cross-Site Request Forgery Bypass

The Sunshine Photo Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.28 This is due to missing or incorrect nonce validation on the sunshineproductsquicksavepost function. This makes it possible for unauthenticated attackers to save custom...