5091 matches found
WordPress FullScreen Menu – Mobile Friendly and Responsive plugin <= 2.2.7 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress FullScreen Menu – Mobile Friendly and Responsive plugin versions = 2.2.7. Solution Update the WordPress FullScreen Menu – Mobile Friendly and Responsive plugin to the latest available version at least...
WordPress Smart Admin Menu Filter plugin <= 1.0.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Smart Admin Menu Filter plugin versions = 1.0.1. Solution No patched version available...
BookingPress < 1.0.11 - Unauthenticated SQL Injection
The plugin fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpressfrontgetcategoryservices AJAX action available to unauthenticated users, leading to an unauthenticated SQL Injection - Create a new "category" and associate i...
PT-2022-9538
Name of the Vulnerable Software and Affected Versions WP Responsive Menu versions prior to 3.1.7.1 Description The issue concerns a lack of capability and CSRF checks in the wpr live update AJAX action, as well as insufficient sanitization and escaping of submitted data. This allows any...
WordPress AP Mega Menu plugin <= 3.0.7 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by Ran Crane in WordPress AP Mega Menu plugin versions = 3.0.7. Solution Update the WordPress AP Mega Menu plugin to the latest available version at least 3.0.8...
WordPress User Menus – Nav Menu Visibility plugin < 1.2.8 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress User Menus – Nav Menu Visibility plugin versions 1.2.8. Solution Update the WordPress User Menus – Nav Menu Visibility plugin to the latest available version at least 1.2.8...
CVE-2021-24971: Improper Neutralization of Input During Web Page Generation
The WP Responsive Menu WordPress plugin before 3.1.7.1 does not have capability and CSRF checks in the wprliveupdate AJAX action, as well as do not sanitise and escape some of the data submitted. As a result, any authenticated, such as subscriber could update the plugin's settings and perform...
WordPress Iks Menu – WordPress Category Accordion Menu plugin <= 1.9.1 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress Iks Menu – WordPress Category Accordion Menu plugin versions = 1.9.1. Solution Update the WordPress Iks Menu – WordPress Category Accordion Menu plugin to the latest available version at least 1.9.2...
WordPress WP Mobile Menu plugin <= 2.8.2.6 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress WP Mobile Menu plugin versions = 2.8.2.6. Solution Update the WordPress WP Mobile Menu plugin to the latest available version at least 2.8.2.7...
Wordpress plugin Float menu cross-site request forgery vulnerability
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in the Wordpress plugin Float menu, which stems fr...
CVE-2022-0313
The Float menu WordPress plugin before 4.3.1 does not have CSRF check in place when deleting menu, which could allow attackers to make a logged in admin delete them via a CSRF attack...
CVE-2022-0313
The Float menu WordPress plugin before 4.3.1 does not have CSRF check in place when deleting menu, which could allow attackers to make a logged in admin delete them via a CSRF attack...
CVE-2022-0313
The Float menu WordPress plugin before 4.3.1 does not have CSRF check in place when deleting menu, which could allow attackers to make a logged in admin delete them via a CSRF attack...
Cross site request forgery (csrf)
The Float menu WordPress plugin before 4.3.1 does not have CSRF check in place when deleting menu, which could allow attackers to make a logged in admin delete them via a CSRF attack...
CVE-2022-0313 Float Menu < 4.3.1 - Arbitrary Menu Deletion via CSRF
The Float menu WordPress plugin before 4.3.1 does not have CSRF check in place when deleting menu, which could allow attackers to make a logged in admin delete them via a CSRF attack...
WordPress Cross-Site Request Forgery Vulnerability
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in the Wordpress plugin Float menu, which stems fr...
WordPress WP Home Page Menu plugin <= 3.0 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting XSS vulnerability discovered by fuzzyap1 in WordPress WP Home Page Menu plugin versions = 3.0. Solution Update the WordPress WP Home Page Menu plugin to the latest available version at least 3.1...
PT-2022-13098
Name of the Vulnerable Software and Affected Versions Float menu WordPress plugin versions prior to 4.3.1 Description The issue concerns a lack of CSRF check when deleting menus, which could allow attackers to make a logged-in admin delete them via a CSRF attack. Recommendations For versions prio...
CommonsBooking < 2.6.8 - Unauthenticated SQL Injection
The plugin does not sanitise and escape the location parameter of the calendardata AJAX action available to unauthenticated users before it is used in dynamically constructed SQL queries, leading to an unauthenticated SQL injection Create an "item" and a "location" via the newly added...
CommonsBooking < 2.6.8 - Unauthenticated SQL Injection
The plugin does not sanitise and escape the location parameter of the calendardata AJAX action available to unauthenticated users before it is used in dynamically constructed SQL queries, leading to an unauthenticated SQL injection PoC Create an "item" and a "location" via the newly added...