CVE-2024-53781

CVE-2024-53781 refers to a CSRF-to-Stored XSS vulnerability in the WordPress plugin SpatialMatch IDX (

WordPress plugin SpatialMatch IDX 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request...

WordPress SpatialMatch IDX plugin <= 3.0.9 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin SpatialMatch IDX versions = 3.0.9...

WordPress RealtyCandy IDX Broker Extended plugin <= 1.5.1 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

CSRF to Stored Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin RealtyCandy IDX Broker Extended versions = 1.5.1...

WordPress RealtyCandy IDX Broker Extended Plugin <= 1.5.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software RealtyCandy IDX Broker Extended Type Plugin Vulnerable versions = 1.5.1 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-53726 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 24b8b3d7db9b Credits...

CVE-2024-52446

Cross-Site Request Forgery CSRF vulnerability in Buying Buddy Buying Buddy IDX CRM buying-buddy-idx-crm allows Object Injection.This issue affects Buying Buddy IDX CRM: from n/a through = 1.2.8...

CVE-2024-52446 WordPress Buying Buddy IDX CRM plugin <= 1.2.8 - CSRF to PHP Object Injection vulnerability

Cross-Site Request Forgery CSRF vulnerability in Buying Buddy Buying Buddy IDX CRM buying-buddy-idx-crm allows Object Injection.This issue affects Buying Buddy IDX CRM: from n/a through = 1.2.8...

CVE-2024-52446 WordPress Buying Buddy IDX CRM plugin <= 1.1.12 - CSRF to PHP Object Injection vulnerability

Cross-Site Request Forgery CSRF vulnerability in Buying Buddy Buying Buddy IDX CRM allows Object Injection.This issue affects Buying Buddy IDX CRM: from n/a through 1.1.12...

CVE-2024-52446

CVE-2024-52446 is a CSRF to PHP Object Injection vulnerability affecting the Buying Buddy IDX CRM WordPress plugin (affected: &lt;= 1.1.12). The core issue is CSRF-enabled object injection, enabling an attacker to trigger unintended object deserialization via forged requests. Public references fr...

PT-2024-35286 · Unknown · Buying Buddy Idx Crm

Name of the Vulnerable Software and Affected Versions: Buying Buddy IDX CRM versions 1.1.12 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Object Injection in Buying Buddy IDX CRM. Recommendations: For versions 1.1.12 and earlier, update to a...

WordPress plugin Buying Buddy IDX CRM 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

WordPress Buying Buddy IDX CRM plugin <= 1.2.8 - CSRF to PHP Object Injection vulnerability

CSRF to PHP Object Injection vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin Buying Buddy IDX CRM versions = 1.2.8...

WordPress Buying Buddy IDX CRM Plugin <= 1.1.12 is vulnerable to Cross Site Request Forgery (CSRF)

Software Buying Buddy IDX CRM Type Plugin Vulnerable versions = 1.1.12 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-52446 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID 6670b1d35a14 Credits Mika Required...

CVE-2024-10003

The Rover IDX plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 3.0.0.2903. This makes it possible for authenticated attackers, with subscriber-level access and...

CVE-2024-10003

The Rover IDX plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 3.0.0.2903. This makes it possible for authenticated attackers, with subscriber-level access and...

CVE-2024-10002

The Rover IDX plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0.0.2905. This is due to insufficient validation and capability check on the 'roveridxrefreshsocialcallback' function. This makes it possible for authenticated attackers, with...

CVE-2024-10002

The Rover IDX plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0.0.2905. This is due to insufficient validation and capability check on the 'roveridxrefreshsocialcallback' function. This makes it possible for authenticated attackers, with...

CVE-2024-10003 Rover IDX <= 3.0.0.2903 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions

The Rover IDX plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 3.0.0.2903. This makes it possible for authenticated attackers, with subscriber-level access and...

CVE-2024-10003

CVE-2024-10003 (Rover IDX for WordPress) affects Rover IDX plugin, versions up to 3.0.0.2903. Root cause is a missing capability check on multiple functions, enabling authenticated attackers with subscriber-level access or higher to add, modify, or delete plugin options, potentially leading to un...

CVE-2024-10003 Rover IDX <= 3.0.0.2903 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions

The Rover IDX plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 3.0.0.2903. This makes it possible for authenticated attackers, with subscriber-level access and...