384 matches found
WordPress nd-shortcodes plugin unauthorized operation vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. nd-shortcodes is a drag-and-drop page builder plugin used in it. A security vulnerability exists in WordPress nd-shortcodes plugin...
Authentication flaw
The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for ndrstimportsettingsphpfunction authentication...
CVE-2019-15819
The CVE-2019-15819 affects the WordPress plugin nd-restaurant-reservations, version prior to 1.5. The root cause is missing authentication for the nd_rst_import_settings_php_function, enabling unauthorized configuration changes. Public records indicate potential impact such as modification of log...
PT-2019-14408
Name of the Vulnerable Software and Affected Versions nd-restaurant-reservations plugin versions prior to 1.5 Description The issue concerns a lack of authentication requirement for the nd rst import settings php function in the nd-restaurant-reservations plugin for WordPress. Recommendations For...
CVE-2019-15819: Missing Authentication for Critical Function
The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for ndrstimportsettingsphpfunction authentication...
CVE-2019-15771
The nd-shortcodes plugin before 6.0 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...
CVE-2019-15771
The nd-shortcodes plugin before 6.0 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...
Code injection
The nd-shortcodes plugin before 6.0 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...
CVE-2019-15771
The nd-shortcodes plugin before 6.0 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...
CVE-2019-15771
Summary: CVE-2019-15771 affects the WordPress plugin “nd-shortcodes” prior to version 6.0. A nopriv_ AJAX action in the plugin allows modification of the siteurl setting. Impact (as stated): This could enable an unauthenticated/privilege-abuse scenario by changing WordPress site URL related confi...
CVE-2019-15774
The nd-booking plugin before 2.5 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...
CVE-2019-15773
The nd-travel plugin before 1.7 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...
CVE-2019-15772
The nd-donations plugin before 1.4 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...
CVE-2019-15775
The nd-learning plugin before 4.8 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...
CVE-2019-15772
The nd-donations plugin before 1.4 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...
CVE-2019-15775
The nd-learning plugin before 4.8 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...
Code injection
The nd-donations plugin before 1.4 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...
Code injection
The nd-booking plugin before 2.5 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...
CVE-2019-15774
The nd-booking plugin before 2.5 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...
CVE-2019-15774
The ND Booking WordPress plugin (versions prior to 2.5 ) is vulnerable to an Unauthenticated Options Change security flaw. An unauthenticated attacker can exploit a nopriv_ AJAX action to modify the siteurl setting or other plugin options. This could allow an attacker to enable development mode, ...