CVE-2026-7561: Cross-Site Request Forgery (CSRF)

The Tm – WordPress Redirection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicio...

PT-2025-10686

Name of the Vulnerable Software and Affected Versions Appsero Helper plugin for WordPress versions up to, and including, 1.3.2 Description The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the 'appsero helper' page. This allows unauthenticated...

PT-2025-2197

Name of the Vulnerable Software and Affected Versions ShopSite plugin for WordPress versions up to, and including, 1.5.10 Description The issue is due to missing or incorrect nonce validation on a function, making it possible for unauthenticated attackers to update settings and inject malicious w...

CVE-2024-13444: Cross-Site Request Forgery (CSRF)

The wp-greet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via...

CVE-2024-12288: Cross-Site Request Forgery (CSRF)

The Simple add pages or posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.0. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to update settings and inject malicious web script...

CVE-2024-5607

The GDPR CCPA Compliance & Cookie Consent Banner plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions named ajaxUpdateSettings in all versions up to, and including, 2.7.0. This makes it possible for authenticated attackers,...

CVE-2022-2864

The demon image annotation plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.7. This is due to missing nonce validation in the /includes/settings.php file. This makes it possible for unauthenticated attackers to modify the plugin's settings and...