WordPress FullScreen Menu – Mobile Friendly and Responsive plugin <= 2.2.7 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress FullScreen Menu – Mobile Friendly and Responsive plugin versions = 2.2.7. Solution Update the WordPress FullScreen Menu – Mobile Friendly and Responsive plugin to the latest available version at least...

WordPress Insert or Embed Articulate Content into WordPress plugin <= 4.3000000015 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Insert or Embed Articulate Content into WordPress plugin versions = 4.3000000015. Solution Update the WordPress Insert or Embed Articulate Content into WordPress plugin to the latest available version ...

WordPress TreePress – Easy Family Trees & Ancestor Profiles plugin < 2.0.21 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress TreePress – Easy Family Trees & Ancestor Profiles plugin versions 2.0.21. Solution Update the WordPress TreePress – Easy Family Trees & Ancestor Profiles plugin to the latest available version at least...

WordPress Free Booking Plugin for Hotels, Restaurant and Car Rental – eaSYNC plugin <= 1.1.9 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Free Booking Plugin for Hotels, Restaurant and Car Rental – eaSYNC plugin versions = 1.1.9. Solution Update the WordPress Free Booking Plugin for Hotels, Restaurant and Car Rental – eaSYNC plugin to th...

WordPress Buttonizer plugin < 2.6.3 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Buttonizer plugin versions 2.6.3. Solution Update the WordPress Buttonizer plugin to the latest available version at least 2.6.3...

WordPress ConeBlog – WordPress Blog Widgets plugin <= 1.4.5 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress ConeBlog – WordPress Blog Widgets plugin versions = 1.4.5. Solution Update the WordPress ConeBlog – WordPress Blog Widgets plugin to the latest available version at least 1.4.6...

PT-2022-13119 · WordPress · Customize Wordpress Emails/Alerts

Name of the Vulnerable Software and Affected Versions: The Customize WordPress Emails and Alerts WordPress plugin versions prior to 1.8.7 Description: The issue concerns a lack of authorization and CSRF check in the bnfw search users AJAX action. This allows any authenticated users to call the...

PT-2022-9454 · WordPress · The Logo Showcase With Slick Slider

Name of the Vulnerable Software and Affected Versions: The Logo Showcase with Slick Slider WordPress plugin versions prior to 1.2.5 Description: The issue concerns a lack of CSRF and authorization checks in the lswss save attachment data AJAX action. This allows any authenticated user to modify...

WordPress Streak CRM For Gmail For Contact Form 7 – WordPress Plugin plugin <= 1.0.8 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Streak CRM For Gmail For Contact Form 7 – WordPress Plugin plugin versions = 1.0.8. Solution No patched version available...

WordPress Domain Mapping System – Manage Unlimited Domains on your Site plugin <= 1.6.7 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Domain Mapping System – Manage Unlimited Domains on your Site plugin versions = 1.6.7. Solution Update the WordPress Domain Mapping System – Manage Unlimited Domains on your Site plugin to the latest...

WordPress Stripe Express plugin < 1.7.7 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Stripe Express plugin versions 1.7.7. Solution Update the WordPress Stripe Express plugin to the latest available version at least 1.7.7...

WordPress Hasium theme < 1.6.5 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Hasium theme versions 1.6.5. Solution Update the WordPress Hasium theme to the latest available version at least 1.6.5...

WordPress WooCommerce Quick Reports plugin <= 2.7.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress WooCommerce Quick Reports plugin versions = 2.7.1. Solution No patched version available...

WordPress Product Options and Price Calculation Formulas for WooCommerce – Uni CPO plugin < 4.9.14 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Product Options and Price Calculation Formulas for WooCommerce – Uni CPO plugin versions 4.9.14. Solution Update the WordPress Product Options and Price Calculation Formulas for WooCommerce – Uni CPO...

CVE-2022-25599

CVE-2022-25599 describes a CSRF vulnerability in the WordPress plugin Spiffy Calendar (versions ≤ 4.9.0) that allows an attacker to trigger event deletion due to missing token validation on the delete request. Multiple sources document the issue and confirm the affected component as the plugin’s ...

CVE-2022-0313

The Float menu WordPress plugin before 4.3.1 does not have CSRF check in place when deleting menu, which could allow attackers to make a logged in admin delete them via a CSRF attack...

CVE-2022-0134

The AnyComment WordPress plugin before 0.2.18 does not have CSRF checks in the Import and Revert HyperComments features, allowing attackers to make logged in admin perform such actions via a CSRF attack...

CVE-2022-0199

The Coming soon and Maintenance mode WordPress plugin before 3.6.8 does not have CSRF check in its comingsoonsendmail AJAX action, allowing attackers to make logged in admin to send arbitrary emails to all subscribed users via a CSRF attack...

CVE-2022-0134

The AnyComment WordPress plugin before 0.2.18 does not have CSRF checks in the Import and Revert HyperComments features, allowing attackers to make logged in admin perform such actions via a CSRF attack...

CVE-2022-0134

The AnyComment WordPress plugin before 0.2.18 does not have CSRF checks in the Import and Revert HyperComments features, allowing attackers to make logged in admin perform such actions via a CSRF attack...