CVE-2023-5383 Funnelforms Free <= 3.4 - Cross-Site Request Forgery to Arbitrary Post Duplication

The Funnelforms Free plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4. This is due to missing or incorrect nonce validation on the fnsfcopyposts function. This makes it possible for unauthenticated attackers to create copies of arbitrary posts...

CVE-2023-5387 Funnelforms Free <= 3.4 - Missing Authorization to Enable/Disable Dark Mode

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsfaf2triggerdarkmode function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and...

CVE-2023-5411 Funnelforms Free <= 3.4 - Missing Authorization to Post Modification

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsfaf2savepost function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to...

CVE-2023-5386 Funnelforms Free <= 3.4 - Missing Authorization to Arbitrary Post Deletion

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsfdeleteposts function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to...

CVE-2023-5386 Funnelforms Free <= 3.4 - Missing Authorization to Arbitrary Post Deletion

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsfdeleteposts function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to...

PT-2023-32084 · WordPress · Funnelforms Free

Name of the Vulnerable Software and Affected Versions: Funnelforms Free plugin for WordPress versions up to and including 3.4 Description: The issue allows authenticated attackers with subscriber-level permissions and above to modify data without proper authorization. This is due to a missing...

WordPress WP Full Stripe Free Plugin <= 7.0.16 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP Full Stripe Free Type Plugin Vulnerable versions = 7.0.16 Fixed in 7.0.18 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-47667 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 6cc196fbcb6c Credits LEE SE HYOUNG...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Mammothology WP Full Stripe Free plugin = 1.6.1 versions...

CVE-2023-46088

CVE-2023-46088 refers to a stored XSS in the WordPress plugin “WP Full Stripe Free” (Mammothology WP Full Stripe Free) affecting versions ≤ 1.6.1. The vulnerability requires administrator privileges (Authenticated) and involves injection of scripts via the plugin’s admin-facing functionality, wit...

WordPress WP Full Stripe Free Plugin < 7.0.6 is vulnerable to Cross Site Scripting (XSS)

Software WP Full Stripe Free Type Plugin Vulnerable versions 7.0.6 Fixed in 7.0.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-46088 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 9105f031f270 Credits LEE SE HYOUNG...

CVE-2023-28934

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Mammothology WP Full Stripe Free plugin = 1.6.1 versions...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Mammothology WP Full Stripe Free plugin = 1.6.1 versions...

CVE-2023-32589

Cross-Site Request Forgery CSRF vulnerability in PingOnline Dyslexiefont Free plugin = 1.0.0 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in PingOnline Dyslexiefont Free plugin = 1.0.0 versions...

CVE-2023-32589 WordPress Dyslexiefont Free Plugin <= 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in PingOnline Dyslexiefont Free plugin = 1.0.0 versions...

CVE-2023-32589

CVE-2023-32589 is a CSRF vulnerability in WordPress Dyslexiefont Free plugin versions 1.0.0 when possible; no active exploit details confirmed in these sources.

WordPress Fantastic Content Protector Free Plugin <= 2.6 is vulnerable to Broken Access Control

Software Fantastic Content Protector Free Type Plugin Vulnerable versions = 2.6 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-25048 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 1ac1ef2d7ef5 Credits Rio Darmawan...

Researchers Find Backdoor in School Management Plugin for WordPress

Multiple versions of a WordPress plugin by the name of "School Management Pro" harbored a backdoor that could grant an adversary complete control over vulnerable websites. The issue, spotted in premium versions before 9.9.7, has been assigned the CVE identifier CVE-2022-1609 and is rated 10 out o...

WordPress 插件 代码问题漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . A remote command execution vulnerability exists in versio...

WordPress HTML5 MP3 Player with Playlist Free Plugin <= 2.6 - Full Path Disclosure

Because of this vulnerability, the attackers can obtain the installation path via a request to html5plus/playlist.php. Solution Upgrade the plugin...