CVE-2023-5387 Funnelforms Free <= 3.4 - Missing Authorization to Enable/Disable Dark Mode

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsfaf2triggerdarkmode function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and...

CVE-2023-5411 Funnelforms Free <= 3.4 - Missing Authorization to Post Modification

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsfaf2savepost function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to...

CVE-2023-5386 Funnelforms Free <= 3.4 - Missing Authorization to Arbitrary Post Deletion

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsfdeleteposts function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to...

CVE-2023-5386 Funnelforms Free <= 3.4 - Missing Authorization to Arbitrary Post Deletion

The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsfdeleteposts function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to...

PT-2023-32084 · WordPress · Funnelforms Free

Name of the Vulnerable Software and Affected Versions: Funnelforms Free plugin for WordPress versions up to and including 3.4 Description: The issue allows authenticated attackers with subscriber-level permissions and above to modify data without proper authorization. This is due to a missing...

WordPress WP Full Stripe Free Plugin <= 7.0.16 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP Full Stripe Free Type Plugin Vulnerable versions = 7.0.16 Fixed in 7.0.18 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-47667 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 6cc196fbcb6c Credits LEE SE HYOUNG...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Mammothology WP Full Stripe Free plugin = 1.6.1 versions...

CVE-2023-46088

CVE-2023-46088 refers to a stored XSS in the WordPress plugin “WP Full Stripe Free” (Mammothology WP Full Stripe Free) affecting versions ≤ 1.6.1. The vulnerability requires administrator privileges (Authenticated) and involves injection of scripts via the plugin’s admin-facing functionality, wit...

WordPress WP Full Stripe Free Plugin < 7.0.6 is vulnerable to Cross Site Scripting (XSS)

Software WP Full Stripe Free Type Plugin Vulnerable versions 7.0.6 Fixed in 7.0.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-46088 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 9105f031f270 Credits LEE SE HYOUNG...

CVE-2023-28934

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Mammothology WP Full Stripe Free plugin = 1.6.1 versions...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Mammothology WP Full Stripe Free plugin = 1.6.1 versions...

CVE-2023-32589

Cross-Site Request Forgery CSRF vulnerability in PingOnline Dyslexiefont Free plugin = 1.0.0 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in PingOnline Dyslexiefont Free plugin = 1.0.0 versions...

CVE-2023-32589

CVE-2023-32589 is a CSRF vulnerability in WordPress Dyslexiefont Free plugin versions 1.0.0 when possible; no active exploit details confirmed in these sources.

CVE-2023-32589 WordPress Dyslexiefont Free Plugin <= 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in PingOnline Dyslexiefont Free plugin = 1.0.0 versions...

WordPress Fantastic Content Protector Free Plugin <= 2.6 is vulnerable to Broken Access Control

Software Fantastic Content Protector Free Type Plugin Vulnerable versions = 2.6 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-25048 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 1ac1ef2d7ef5 Credits Rio Darmawan...

Researchers Find Backdoor in School Management Plugin for WordPress

Multiple versions of a WordPress plugin by the name of "School Management Pro" harbored a backdoor that could grant an adversary complete control over vulnerable websites. The issue, spotted in premium versions before 9.9.7, has been assigned the CVE identifier CVE-2022-1609 and is rated 10 out o...

WordPress 插件 代码问题漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . A remote command execution vulnerability exists in versio...

WordPress HTML5 MP3 Player with Playlist Free Plugin <= 2.6 - Full Path Disclosure

Because of this vulnerability, the attackers can obtain the installation path via a request to html5plus/playlist.php. Solution Upgrade the plugin...