WordPress Voting Record Plugin <= 2.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Voting Record Type Plugin Vulnerable versions = 2.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-7083 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 6107adacfb26 Credits Daniel Ruf Required...

WordPress Voting Record Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)

Software Voting Record Type Plugin Vulnerable versions = 2.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-7084 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 4244145376c3 Credits Daniel Ruf Required...

WordPress WP-Polls plugin <= 2.75.6 - IP Validation Bypass vulnerability

IP Validation Bypass vulnerability discovered by Daniel Ruf in WordPress WP-Polls plugin versions = 2.75.6. Solution Update the WordPress WP-Polls plugin to the latest available version at least 2.76.0...

WordPress Webmaster Tools Verification plugin <= 1.2 - Unauthenticated Arbitrary Plugin Deactivation vulnerability

Unauthenticated Arbitrary Plugin Deactivation vulnerability discovered by Daniel Ruf in WordPress Webmaster Tools Verification plugin versions = 1.2. Solution Deactivate and delete. This plugin has been closed as of October 19, 2022 and is not available for download. This closure is temporary,...

WordPress LBStopAttack plugin <= 1.1.2 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability leading to Arbitrary Settings Update discovered by Daniel Ruf in WordPress LBStopAttack plugin versions = 1.1.2. Solution Update the WordPress LBstopattack plugin to the latest available version at least 1.1.3...

WordPress Site Offline plugin <= 1.4.9 - Access Bypass vulnerability

Access Bypass vulnerability discovered by Daniel Ruf in WordPress Site Offline plugin versions = 1.4.9. Solution Update the WordPress Site Offline plugin to the latest available version at least 1.5.3...

WordPress Ping Optimizer plugin <= 2.35.1.2.3 - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF) vulnerability

Arbitrary Settings Update via Cross-Site Request Forgery CSRF vulnerability discovered by Daniel Ruf in WordPress Ping Optimizer plugin versions = 2.35.1.3.0. Solution Update the WordPress WordPress Ping Optimizer plugin to the latest available version at least 2.35.1.3.0...

WordPress Stop Spam Comments plugin <= 0.2.1.2 - Access Token Bypass vulnerability

Access Token Bypass vulnerability discovered by Daniel Ruf in WordPress Stop Spam Comments plugin versions = 0.2.1.2. Solution Deactivate and delete. This plugin has been closed as of August 3, 2022 and is not available for download. This closure is temporary, pending a full review...

WordPress Simple Job Board plugin <= 2.9.6 - Resume Disclosure via Directory Listing

Resume Disclosure via Directory Listing was discovered by Daniel Ruf in the WordPress Simple Job Board plugin versions = 2.9.6. Solution Update the WordPress Simple Job Board plugin to the latest available version at least 2.10.0...

WordPress Ninja Job Board plugin <= 1.3.1 - Resume Disclosure via Directory Listing

Resume Disclosure via Directory Listing discovered by Daniel Ruf in WordPress Ninja Job Board plugin versions = 1.3.1. Solution Update the WordPress Ninja Job Board plugin to the latest available version at least 1.3.3...

WordPress Auto-hyperlink URLs plugin <= 5.4.1 - Tab Nabbing vulnerability

Tab Nabbing vulnerability discovered by Daniel Ruf in WordPress Auto-hyperlink URLs plugin versions = 5.4.1. Solution Deactivate and delete. This plugin has been closed as of July 18, 2022 and is not available for download. This closure is temporary, pending a full review...

WordPress Project Source Code Download plugin <= 1.0.0 - Unauthenticated Backup Download vulnerability

Unauthenticated Backup Download vulnerability discovered by Daniel Ruf in WordPress Project Source Code Download plugin versions = 1.0.0. Solution Deactivate and delete. This plugin has been closed as of May 4, 2022 and is not available for download. Reason: Security Issue...

WordPress YOP Poll plugin <= 6.4.2 - IP Spoofing vulnerability

IP Spoofing vulnerability discovered by Daniel Ruf in WordPress YOP Poll plugin versions = 6.4.2. Solution Update the WordPress YOP Poll plugin to the latest available version at least 6.4.3...

WordPress Flexi Quote Rotator plugin <= 0.9.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Daniel Ruf in WordPress Flexi Quote Rotator plugin versions = 0.9.4. Solution Deactivate and delete. This plugin has been closed as of July 6, 2022 and is not available for download. This closure is temporary, pending a ful...

WordPress WP Maintenance Mode & Coming Soon plugin <= 2.4.4 - Subscribed Users Deletion via Cross-Site Request Forgery (CSRF) vulnerability

Subscribed Users Deletion via Cross-Site Request Forgery CSRF vulnerability discovered by Daniel Ruf in WordPress WP Maintenance Mode & Coming Soon plugin versions = 2.4.4. Solution Update the WordPress WP Maintenance Mode & Coming Soon plugin to the latest available version at least 2.4.5...

WordPress Cache Images plugin <= 3.2 - Image Upload / Import via Cross-Site Request Forgery (CSRF) vulnerability

Image Upload / Import via Cross-Site Request Forgery CSRF vulnerability was discovered by Daniel Ruf in the WordPress Cache Images plugin versions = 3.2. Solution Update the WordPress Cache Images plugin to the latest available version at least 3.2.1...

WordPress WP Opt-in plugin <= 1.4.1 - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF) vulnerability

Arbitrary Settings Update via Cross-Site Request Forgery CSRF vulnerability discovered by Daniel Ruf in WordPress WP Opt-in plugin versions = 1.4.1. Solution Deactivate and delete. This plugin has been closed as of June 15, 2022 and is not available for download. This closure is temporary, pendin...

WordPress Sharebar plugin <= 1.4.1 - Arbitrary Settings Update to Stored XSS via CSRF vulnerability

Arbitrary Settings Update to Stored XSS via CSRF vulnerability discovered by Daniel Ruf in WordPress Sharebar plugin versions = 1.4.1. Solution Deactivate and delete. This plugin has been closed as of June 14, 2022 and is not available for download. This closure is temporary, pending a full revie...

WordPress wp-championship plugin <= 9.2 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities

Multiple Cross-Site Request Forgery CSRF vulnerabilities were discovered by Daniel Ruf in the WordPress wp-championship plugin versions = 9.2. Solution Update the WordPress WP Championship plugin to the latest available version at least 9.3...

WordPress MyCSS plugin <= 1.1 - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF) vulnerability

Arbitrary Settings Update via Cross-Site Request Forgery CSRF vulnerability was discovered by Daniel Ruf in the WordPress MyCSS plugin versions = 1.1. Solution Deactivate and delete. This plugin has been closed as of May 31, 2022 and is not available for download. This closure is temporary, pendi...