CVE-2024-13523: Cross-Site Request Forgery (CSRF)

The MemorialDay plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web script...

CVE-2024-13852: Cross-Site Request Forgery (CSRF)

The Option Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing nonce validation on the pluginpage function. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forged request, grant...

PT-2025-6617

Name of the Vulnerable Software and Affected Versions Option Editor plugin for WordPress version 1.0 Description The issue is due to missing nonce validation on the plugin page function, making it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forge...

CVE-2024-13522: Cross-Site Request Forgery (CSRF)

The magayo Lottery Results plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.12. This is due to missing or incorrect nonce validation on the 'magayo-lottery-results' page. This makes it possible for unauthenticated attackers to update...

PT-2025-6539

Name of the Vulnerable Software and Affected Versions Shopwarden – Automated WooCommerce monitoring & testing plugin for WordPress versions up to, and including, 1.0.11 Description The issue is due to missing or incorrect nonce validation on the save setting function. This makes it possible for...

CVE-2024-10581

The DirectoryPress Frontend plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.9. This is due to missing or incorrect nonce validation on the dpfllistingStatusChange function. This makes it possible for unauthenticated attackers to update...

CVE-2025-0808

The Houzez Property Feed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.21. This is due to missing or incorrect nonce validation on the "deleteexport" action. This makes it possible for unauthenticated attackers to delete property feed...

PT-2025-6431

Name of the Vulnerable Software and Affected Versions StaffList plugin for WordPress versions up to, and including, 3.2.3 Description The issue is due to missing or incorrect nonce validation on the 'stafflist' page, making it possible for unauthenticated attackers to update settings and inject...

CVE-2024-13437: Cross-Site Request Forgery (CSRF)

The Book a Room plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.9. This is due to missing or incorrect nonce validation on the 'bookaroomSettings' page. This makes it possible for unauthenticated attackers to update the plugin's settings vi...

CVE-2024-12386: Cross-Site Request Forgery (CSRF)

The WP Abstracts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.3. This is due to missing nonce validation on multiple functions. This makes it possible for unauthenticated attackers to delete arbitrary accounts via a forged request...

PT-2025-6520

Name of the Vulnerable Software and Affected Versions WP Abstracts plugin for WordPress versions up to, and including, 2.7.3 Description The issue is due to missing nonce validation on multiple functions, making it possible for unauthenticated attackers to delete arbitrary accounts via a forged...

CVE-2024-13749: Improper Neutralization of Input During Web Page Generation

The StaffList plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.3. This is due to missing or incorrect nonce validation on the 'stafflist' page. This makes it possible for unauthenticated attackers to update settings and inject malicious we...

CVE-2025-0808: Cross-Site Request Forgery (CSRF)

The Houzez Property Feed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.21. This is due to missing or incorrect nonce validation on the "deleteexport" action. This makes it possible for unauthenticated attackers to delete property feed...

CVE-2024-9661: Cross-Site Request Forgery (CSRF)

The WP All Import Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.9.7. This is due to missing nonce validation on the deleteandedit function. This makes it possible for unauthenticated attackers to delete imported content posts, comment...

CVE-2024-12293

The User Role Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.64.3. This is due to missing or incorrect nonce validation on the updateroles function. This makes it possible for unauthenticated attackers to add or remove roles for...

CVE-2024-0203

The Digits plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.1. This is due to missing nonce validation in the 'digitssavesettings' function. This makes it possible for unauthenticated attackers to modify the default role of registered users to...

CVE-2024-13356

The DSGVO All in one for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6. This is due to missing or incorrect nonce validation in the userremoveform.php file. This makes it possible for unauthenticated attackers to delete admin user...

PT-2025-2197

Name of the Vulnerable Software and Affected Versions ShopSite plugin for WordPress versions up to, and including, 1.5.10 Description The issue is due to missing or incorrect nonce validation on a function, making it possible for unauthenticated attackers to update settings and inject malicious w...

PT-2025-9452

Name of the Vulnerable Software and Affected Versions Social Links versions prior to 1.0.12 Description The Social Links plugin for WordPress contains a Cross-Site Request Forgery CSRF and Stored Cross-Site Scripting XSS issue. The flaw stems from missing or incorrect nonce validation—a security...

CVE-2024-13521

The MailUp Auto Subscription plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing or incorrect nonce validation on the masoptions function. This makes it possible for unauthenticated attackers to update settings and...