CVE-2024-4103 ADFO – Custom data in admin dashboard <= 1.9.0 - Cross-Site Request Forgery

The ADFO – Custom data in admin dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.0. This is due to missing or incorrect nonce validation on several functions hooked via the controller function. This makes it possible for...

CVE-2024-4103

CVE-2024-4103 affects ADFO – Custom data in admin dashboard for WordPress. It is a CSRF vulnerability in all versions up to 1.9.0 caused by missing/incorrect nonce validation on functions hooked via the controller() function, enabling unauthenticated attackers to edit plugin settings if a site ad...

CVE-2024-4314 hostel <= 1.1.5.3 - Cross-Site Request Forgery

The Hostel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.5.3. This is due to missing or incorrect nonce validation when managing rooms. This makes it possible for unauthenticated attackers to create and delete rooms via a forged request...

CVE-2024-4314

CVE-2024-4314 affects the Hostel WordPress plugin up through version 1.1.5.3, where CSRF exists due to missing/incorrect nonce validation in room management. This allows unauthenticated attackers to trigger actions (e.g., create or delete rooms) by enticing an admin to click a crafted link. The C...

CVE-2024-4312 Soccer Engine – Soccer Plugin for WordPress <= 1.12 - Cross-Site Request Forgery

The Soccer Engine – Soccer Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12. This is due to missing or incorrect nonce validation when saving match and team settings. This makes it possible for unauthenticated attacke...

CVE-2024-4312

CVE-2024-4312 concerns the Soccer Engine – Soccer Plugin for WordPress, vulnerable to Cross-Site Request Forgery in versions up to 1.12 due to missing or incorrect nonce validation when saving match and team settings. The vulnerability could allow unauthenticated attackers to change plugin settin...

PT-2024-31200 · WordPress · Squelch Tabs/Accordions Shortcodes

Name of the Vulnerable Software and Affected Versions: Squelch Tabs and Accordions Shortcodes plugin for WordPress versions up to, and including, 0.4.7 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation when saving plugin settings. This...

EWWW Image Optimizer < 7.3.0 - Cross-Site Request Forgery

Description The EWWW Image Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.2.3. This is due to missing or incorrect nonce validation on the checkforoptin and checkforoptout functions. This makes it possible for unauthenticated...

Popup box < 4.1.3 - Cross-Site Request Forgery

Description The Popup box plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.1.2. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged...

Xserver Migrator < 1.6.2.1 - Arbitrary File Upload via CSRF

Description The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to upload arbitrary files granted they can trick a site administrator into performing an action such as...

Restaurant and Cafe < 1.2.2 - Cross-Site Request Forgery to Notice Dismissal

Description The Restaurant and Cafe theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to dismiss notices via a forged...

ADFO – Custom data in admin dashboard < 1.9.1 - Cross-Site Request Forgery

Description The ADFO – Custom data in admin dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.0. This is due to missing or incorrect nonce validation on several functions hooked via the controller function. This makes it possible...

Soccer Engine – Soccer Plugin for WordPress < 1.13 - Cross-Site Request Forgery

Description The Soccer Engine – Soccer Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12. This is due to missing or incorrect nonce validation when saving match and team settings. This makes it possible for...

Squelch Tabs and Accordions Shortcodes < 0.4.8 - Cross-Site Request Forgery

Description The Squelch Tabs and Accordions Shortcodes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.4.7. This is due to missing or incorrect nonce validation when saving plugin settings. This makes it possible for unauthenticated attacke...

Easy PopUp Show <= 0.12 - Cross-Site Request Forgery

Description The easy-popup-show plugin for WordPress is vulnerable to Cross-Site Request Forgery in version all versions. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an unauthorized action granted the...

hostel < 1.1.5.4 - Cross-Site Request Forgery

Description The Hostel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.5.3. This is due to missing or incorrect nonce validation when managing rooms. This makes it possible for unauthenticated attackers to create and delete rooms via a...

CVE-2023-7065

The Stop Spammers Security | Block Spam Users, Comments, Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2024.4. This is due to missing or incorrect nonce validation on the sfsprocess AJAX action. This makes it possible for...

CVE-2023-7065

CVE-2023-7065 affects Stop Spammers Security | Block Spam Users, Comments, Forms (WordPress) up to version 2024.4. Root cause: missing/incorrect nonce validation on the sfs_process AJAX action. Impact: unauthenticated attackers can forge requests to add arbitrary IPs to the plugin’s allowlist and...

CVE-2023-7065 Stop Spammers Security | Block Spam Users, Comments, Forms <= 2024.4 - Cross-Site Request Forgery (CSRF) via sfs_process

The Stop Spammers Security | Block Spam Users, Comments, Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2024.4. This is due to missing or incorrect nonce validation on the sfsprocess AJAX action. This makes it possible for...

PT-2024-15194 · WordPress · Stop Spammers Security

Name of the Vulnerable Software and Affected Versions: Stop Spammers Security | Block Spam Users, Comments, Forms plugin for WordPress versions up to, and including, 2024.4 Description: The issue is due to missing or incorrect nonce validation on the sfs process AJAX action, making it possible fo...