PT-2019-7391

Name of the Vulnerable Software and Affected Versions alpine-photo-tile-for-instagram plugin versions prior to 1.2.7.6 Description The issue concerns a CSRF vulnerability that can lead to XSS. It is exploited via the "tab" parameter in the...

CVE-2015-9387

The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/options-general.php CSRF...

Cross site request forgery (csrf)

The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/options-general.php CSRF...

CVE-2019-16531

LayerBB before 1.1.4 has multiple CSRF issues, as demonstrated by changing the System Settings via admin/general.php...

PT-2019-14689

Name of the Vulnerable Software and Affected Versions LayerBB versions prior to 1.1.4 Description The issue allows for multiple CSRF problems, which can be demonstrated by modifying the System Settings through the "admin/general.php" endpoint, specifically by exploiting the lack of proper CSRF...

PT-2019-7367

Name of the Vulnerable Software and Affected Versions xpinner-lite plugin versions through 2.2 for WordPress Description The issue concerns a CSRF vulnerability with resultant XSS in the wp-admin/options-general.php endpoint. This allows for cross-site request forgery attacks that can lead to...

PT-2019-7346

Name of the Vulnerable Software and Affected Versions mtouch-quiz plugin versions prior to 3.1.3 for WordPress Description The issue concerns a CSRF vulnerability in the wp-admin/options-general.php endpoint. This allows for potential unauthorized actions. No information is provided about the...

CVE-2015-9387: Cross-Site Request Forgery (CSRF)

The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/options-general.php CSRF...

CVE-2019-16531: Cross-Site Request Forgery (CSRF)

LayerBB before 1.1.4 has multiple CSRF issues, as demonstrated by changing the System Settings via admin/general.php...

CVE-2015-9408: Cross-Site Request Forgery (CSRF)

The xpinner-lite plugin through 2.2 for WordPress has wp-admin/options-general.php CSRF with resultant XSS...

CVE-2017-18521

The democracy-poll plugin before 5.4 for WordPress has CSRF via wp-admin/options-general.php?page=democracy-poll&subpage=l10n...

PT-2019-8455

Name of the Vulnerable Software and Affected Versions democracy-poll plugin versions prior to 5.4 Description The issue concerns a CSRF problem. It can be exploited via the "wp-admin/options-general.php?page=democracy-poll&subpage=l10n" API endpoint. Recommendations For versions prior to 5.4,...

CVE-2017-18521: Cross-Site Request Forgery (CSRF)

The democracy-poll plugin before 5.4 for WordPress has CSRF via wp-admin/options-general.php?page=democracy-poll&subpage=l10n...

CVE-2019-14682

The acf-better-search aka ACF: Better Search plugin before 3.3.1 for WordPress allows wp-admin/options-general.php?page=acfbsadminpage CSRF...

CVE-2019-14682: Cross-Site Request Forgery (CSRF)

The acf-better-search aka ACF: Better Search plugin before 3.3.1 for WordPress allows wp-admin/options-general.php?page=acfbsadminpage CSRF...

CVE-2019-14681: Cross-Site Request Forgery (CSRF)

The Deny All Firewall plugin before 1.1.7 for WordPress allows wp-admin/options-general.php?page=dafsettings&dafremove=true CSRF...

PT-2019-13777

Name of the Vulnerable Software and Affected Versions Deny All Firewall plugin versions prior to 1.1.7 Description The issue allows for a CSRF attack via the wp-admin/options-general.php?page=daf settings&daf remove=true endpoint, potentially affecting the security of WordPress installations usin...

PT-2019-13778

Name of the Vulnerable Software and Affected Versions acf-better-search plugin versions prior to 3.3.1 Description The issue allows for a CSRF attack via the wp-admin/options-general.php?page=acfbs admin page endpoint. Recommendations For acf-better-search plugin versions prior to 3.3.1, update t...

CVE-2019-13973

CVE-2019-13973 affects LayerBB 1.1.3, where the admin/general.php arbitrary file upload is possible because the custom_logo filename suffix is not restricted, allowing a ".php" file. The vulnerability stems from insufficient validation of uploaded logo names, enabling potential remote code execut...

CVE-2019-13973: Unrestricted Upload of File with Dangerous Type

LayerBB 1.1.3 allows admin/general.php arbitrary file upload because the customlogo filename suffix is not restricted, and .php may be used...