Name Directory < 1.25.4 - Arbitrary Directory/Name Deletion via CSRF

The plugin does not have CSRF checks in place when deleting Directories and Names, which could allow attackers to make a logged in admin delete them via a CSRF attack PoC https://example.com/wp-admin/admin.php?page=name-directorydir=2...

WordPress Name Directory plugin <= 1.25.2 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Donato Di Pasquale in WordPress Name Directory plugin versions = 1.25.2. Solution Update the WordPress Name Directory plugin to the latest available version at least 1.25.3...

Name Directory < 1.25.4 - Stored Cross-Site Scripting via CSRF

The plugin does not have CSRF check when importing names, and is also lacking sanitisation as well as escaping in some of the imported data, which could allow attackers to make a logged in admin import arbitrary names with XSS payloads in them. PoC As admin, Import the following CSV...

Name Directory < 1.25.4 - Stored Cross-Site Scripting via CSRF

The plugin does not have CSRF check when importing names, and is also lacking sanitisation as well as escaping in some of the imported data, which could allow attackers to make a logged in admin import arbitrary names with XSS payloads in them. function submitRequest var xhr = new XMLHttpRequest;...

WordPress Name Directory plugin <= 1.25.3 - Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability

Stored Cross-Site Scripting XSS via Cross-Site Request Forgery CSRF vulnerability discovered by Donato Di Pasquale in WordPress Name Directory plugin versions = 1.25.3. Solution Update the WordPress Name Directory plugin to the latest available version at least 1.25.4...

Wordpress name-directory cross-site request forgery vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL.Wordpress name-directory is a plugin that provides directory functionality for the Wordpress platform...

CVE-2021-20652

Cross-site request forgery CSRF vulnerability in Name Directory 1.17.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...

CVE-2021-20652

Cross-site request forgery CSRF vulnerability in Name Directory 1.17.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...

CVE-2021-20652

Cross-site request forgery CSRF vulnerability in Name Directory 1.17.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Name Directory 1.17.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...

CVE-2021-20652

Cross-site request forgery CSRF vulnerability in Name Directory 1.17.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...

CVE-2021-20652

Cross-site request forgery CSRF vulnerability in Name Directory 1.17.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...

CVE-2021-20652

CVE-2021-20652 is the WordPress Name Directory plugin CSRF vulnerability affecting versions 1.17.4 and earlier. A remote attacker could hijack an administrator’s session via cross-site requests; vectors are not specified in the provided documents. Remediation per connected sources is to update th...

WordPress Plugin "Name Directory" vulnerable to cross-site request forgery

Overview WordPress Plugin "Name Directory" provided by J. Peters contains a cross-site request forgery vulnerability CWE-352. Yuta Asai of Cryptography Laboratory, Department of Information and Communication Engineering, Tokyo Denki University reported this vulnerability to the developer and...

Name Directory < 1.18 - Cross-Site Request Forgery (CSRF)

The plugin was affected by CSRF issues, allowing attackers to make a logged in administrator perform unwanted actions...

Wordpress name-directory Plugin 跨站请求伪造漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL.Wordpress name-directory is a plugin that provides directory functionality for the Wordpress platform...

CVE-2021-20652: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Name Directory 1.17.4 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...

JVN#50470170: WordPress Plugin "Name Directory" vulnerable to cross-site request forgery

WordPress Plugin "Name Directory" provided by J. Peters contains a cross-site request forgery vulnerability CWE-352. Impact If a user with an administrative privilege views a malicious page while logged in, unintended operations may be performed. Solution Update the plugin Update the plugin...

PT-2021-14113

Name of the Vulnerable Software and Affected Versions: Name Directory versions 1.17.4 and earlier Description: A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators via unspecified vectors. Recommendations: For versions 1.17.4 and earlier,...

WordPress Name Directory plugin <= 1.17.4 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found by Yuta in WordPress Name Directory plugin versions = 1.17.4. Solution Update the WordPress Name Directory plugin to the latest available version at least 1.18...