WordPress FAQ Manager For Divi, Gutenberg Block & Shortcode plugin <= 5.4.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress FAQ Manager For Divi, Gutenberg Block & Shortcode plugin versions = 5.4.0. Solution Update the WordPress FAQ Manager For Divi, Gutenberg Block & Shortcode plugin to the latest available version at leas...

WordPress Accordion & FAQ – Helpie WordPress Accordion FAQ Plugin plugin <= 1.7.6 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Accordion & FAQ – Helpie WordPress Accordion FAQ Plugin plugin versions = 1.7.6. Solution Update the WordPress Accordion & FAQ – Helpie WordPress Accordion FAQ Plugin plugin to the latest available version at least 1.7.7...

WordPress Flexible FAQs – Accordion FAQ Plugin for WordPress plugin <= 0.5.10 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Flexible FAQs – Accordion FAQ Plugin for WordPress plugin versions = 0.5.10. Solution Update the WordPress Flexible FAQs – Accordion FAQ Plugin for WordPress plugin to the latest available version at...

WordPress Ultimate FAQ plugin cross-site request forgery vulnerability

WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. cross-site request forgery vulnerability exists in versions prior to 2.1.2 of the Ultimate FAQ plugin for...

CVE-2021-24968

The Ultimate FAQ WordPress plugin before 2.1.2 does not have capability and CSRF checks in the ewdufaqwelcomeaddfaq and ewdufaqwelcomeaddfaqpage AJAX actions, available to any authenticated users. As a result, any users, with a role as low as Subscriber could create FAQ and FAQ questions...

CVE-2021-24968

The Ultimate FAQ WordPress plugin before 2.1.2 does not have capability and CSRF checks in the ewdufaqwelcomeaddfaq and ewdufaqwelcomeaddfaqpage AJAX actions, available to any authenticated users. As a result, any users, with a role as low as Subscriber could create FAQ and FAQ questions...

CVE-2021-24968

The Ultimate FAQ WordPress plugin before 2.1.2 does not have capability and CSRF checks in the ewdufaqwelcomeaddfaq and ewdufaqwelcomeaddfaqpage AJAX actions, available to any authenticated users. As a result, any users, with a role as low as Subscriber could create FAQ and FAQ questions...

Cross site request forgery (csrf)

The Ultimate FAQ WordPress plugin before 2.1.2 does not have capability and CSRF checks in the ewdufaqwelcomeaddfaq and ewdufaqwelcomeaddfaqpage AJAX actions, available to any authenticated users. As a result, any users, with a role as low as Subscriber could create FAQ and FAQ questions...

CVE-2021-24968 Ultimate FAQ < 2.1.2 - Subscriber+ Arbitrary FAQ Creation

The Ultimate FAQ WordPress plugin before 2.1.2 does not have capability and CSRF checks in the ewdufaqwelcomeaddfaq and ewdufaqwelcomeaddfaqpage AJAX actions, available to any authenticated users. As a result, any users, with a role as low as Subscriber could create FAQ and FAQ questions...

CVE-2021-24968

The CVE-2021-24968 affects the WordPress Ultimate FAQ plugin (versions prior to 2.1.2). The issue is a lack of capability and CSRF checks in the AJAX actions ewd_ufaq_welcome_add_faq and ewd_ufaq_welcome_add_faq_page, making them accessible to any authenticated user (down to Subscriber). This can...

PT-2022-9537 · WordPress · The Ultimate Faq

Name of the Vulnerable Software and Affected Versions: The Ultimate FAQ WordPress plugin versions prior to 2.1.2 Description: The issue concerns the lack of capability and CSRF checks in the ewd ufaq welcome add faq and ewd ufaq welcome add faq page AJAX actions. This allows any authenticated use...

WordPress 跨站请求伪造漏洞

WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. cross-site request forgery vulnerability exists in versions prior to 2.1.2 of the Ultimate FAQ plugin for...

Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2022-3.0-0346

An update of 'bluez', 'pkg-config', 'consul', 'httpd', 'vim' packages of Photon OS has been released...

Ultimate FAQ < 2.1.2 - Subscriber+ Arbitrary FAQ Creation

The plugin does not have capability and CSRF checks in the ewdufaqwelcomeaddfaq and ewdufaqwelcomeaddfaqpage AJAX actions, available to any authenticated users. As a result, any users, with a role as low as Subscriber could create FAQ and FAQ questions...

Ultimate FAQ < 2.1.2 - Subscriber+ Arbitrary FAQ Creation

The plugin does not have capability and CSRF checks in the ewdufaqwelcomeaddfaq and ewdufaqwelcomeaddfaqpage AJAX actions, available to any authenticated users. As a result, any users, with a role as low as Subscriber could create FAQ and FAQ questions PoC...

Spoofing

We have investigated reports of a spoofing vulnerability in AppX installer that affects Microsoft Windows. Microsoft is aware of attacks that attempt to exploit this vulnerability by using specially crafted packages that include the malware family known as Emotet/Trickbot/Bazaloader. An attacker...

WordPress Best WordPress FAQ plugin <= 1.4.8 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by p7e4 in WordPress Best WordPress FAQ plugin versions = 1.4.8. Solution Deactivate and delete. This plugin has been closed as of December 3, 2021 and is not available for download. This closure is temporary, pending a full review...

Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2022-3.0-0338

An update of 'vim' packages of Photon OS has been released...

Tab - Accordion, FAQ < 1.3.2 - Unauthenticated AJAX Calls

All AJAX actions of the plugin are available to both unauthenticated and authenticated users, allowing unauthenticated attackers to modify various data in the plugin, such as add/edit/delete arbitrary tabs. v1.3.0 added CSRF checks, however authorisation was still missing and has been added in...

WordPress Tab – Accordion, FAQ plugin <= 1.3.1 - Unauthenticated AJAX Calls vulnerability

Unauthenticated AJAX Calls vulnerability discovered by Brandon Roldan in WordPress Tab – Accordion, FAQ plugin versions = 1.3.1. Solution Update the WordPress Tab – Accordion, FAQ plugin to the latest available version at least 1.3.2...