Plugin Name: Device Theme Switcher <= 3.0.2 - Cross-Site Request Forgery

Description The Plugin Name: Device Theme Switcher plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.2. This is due to missing or incorrect nonce validation on the saveadminpagesettings function. This makes it possible for unauthenticated...

Patreon WordPress < 1.8.8 - Cross-Site Request Forgery

Description The Patreon WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.7. This is due to missing or incorrect nonce validation on several functions in the /classes/patreonwordpress.php file. This makes it possible for unauthenticat...

EasyRecipe <= 3.5.3251 - Cross-Site Request Forgery

Description The EasyRecipe plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.3251. This is due to missing nonce validation on several functions such as the saveStyle and updateCustomCSS functions. This makes it possible for unauthenticated...

Best Restaurant Menu by PriceListo <= 1.3.1 - Cross-Site Request Forgery via menu_page

Description The Best Restaurant Menu by PriceListo plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.1. This is due to missing or incorrect nonce validation on the menupage function. This makes it possible for unauthenticated attackers to modif...

WCP OpenWeather <= 2.5.0 - Cross-Site Request Forgery

Description The WCP OpenWeather plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.0. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an unknown...

WP Category Post List Widget <= 2.0.3 - Cross-Site Request Forgery via gen_set_page

Description The WP Category Post List Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.3. This is due to missing or incorrect nonce validation on the 'gensetpage' function. This makes it possible for unauthenticated attackers to modify...

Preloader Matrix <= 2.0.1 - Cross-Site Request Forgery

Description The Preloader Matrix plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.1. This is due to missing or incorrect nonce validation on the handleEndPoint function. This makes it possible for unauthenticated attackers to modify the plugin...

UserPro < 5.1.2 - Cross-Site Request Forgery to Sensitive Information Exposure

Description The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing or incorrect nonce validation on the 'exportusers' function. This makes it possible for unauthenticated attackers to export the users to a csv...

UserPro < 5.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via userpro_save_userdata

Description The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.0. This is due to missing or incorrect nonce validation on the 'userprosaveuserdata' function. This makes it possible for unauthenticated attackers to update the user met...

Auto Limit Posts Reloaded <= 2.5 - Cross-Site Request Forgery

Description The Auto Limit Posts Reloaded plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5. This is due to missing or incorrect nonce validation on the alpradmin function. This makes it possible for unauthenticated attackers to modify the...

UserPro < 5.1.1 - Cross-Site Request Forgery to PHP Object Injection

Description The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.0. This is due to missing or incorrect nonce validation on the 'importsettings' function. This makes it possible for unauthenticated attackers to exploit PHP Object...

Auto Excerpt everywhere <= 1.5 - Cross-Site Request Forgery

Description The Auto Excerpt everywhere plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the autoexcerpteverywhereoptions function and included options.php file. This makes it possible f...

Alter <= 1.0 - Cross-Site Request Forgery

Description The Alter plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the alterconf function. This makes it possible for unauthenticated attackers to modify the plugin's settings via a...

Current Menu Item for Custom Post Types < 1.6 - Cross-Site Request Forgery

Description The Current Menu Item for Custom Post Types plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the cmicptview function. This makes it possible for unauthenticated attackers to...

Post Meta Data Manager < 1.2.2 - Cross-Site Request Forgery to Post, Term, and User Meta Deletion

Description The Post Meta Data Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing nonce validation on the pmdmwpajaxdeletemeta, pmdmwpdeleteusermeta, and pmdmwpdeleteusermeta functions. This makes it possibl...

Add Local Avatar <= 12.1 - Cross-Site Request Forgery via manage_avatar_cache

Description The Add Local Avatar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 12.1. This is due to missing or incorrect nonce validation on the manageavatarcache function. This makes it possible for unauthenticated attackers to manage avatars ...

Custom Header Images <= 1.2.1 - Cross-Site Request Forgery

Description The Custom Header Images plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an unknow...

video carousel slider with lightbox 1.0 - Cross-Site Request Forgery

Description The video carousel slider with lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing or incorrect nonce validation on the responsivevideogallerywithlightboxvideomanagementfunc function. This makes it possible for unauthenticat...

Legal Pages < 1.3.9 - Cross-Site Request Forgery via moveToTrash and fetch_and_insert_template_data

Description The Legal Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.8. This is due to missing or incorrect nonce validation on the moveToTrash and fetchandinserttemplatedata functions. This makes it possible for unauthenticated...

WP Helper Premium < 4.5.2 - Cross-Site Request Forgery via whp_fields

Description The WP Helper Premium plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.1. This is due to missing or incorrect nonce validation on the 'whpfields' function. This makes it possible for unauthenticated attackers to update the plugin...