CVE-2023-5776

CVE-2023-5776 (Post Meta Data Manager, WordPress) is a CSRF vulnerability in all versions up to 1.2.1 due to missing nonce validation on meta deletion endpoints (pmdm_wp_ajax_delete_meta, pmdm_wp_delete_user_meta, pmdm_wp_delete_user_meta). Unauthenticated attackers can forge requests to delete a...

CVE-2023-6196

The Audio Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0.4. This is due to missing or incorrect nonce validation on the function audiomerchantaddaudiofile function. This makes it possible for unauthenticated attackers to upload...

Cross site request forgery (csrf)

The Audio Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0.4. This is due to missing or incorrect nonce validation on the function audiomerchantaddaudiofile function. This makes it possible for unauthenticated attackers to upload...

Cross site request forgery (csrf)

The Audio Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0.4. This is due to missing or incorrect nonce validation on the audiomerchantsavesettings function. This makes it possible for unauthenticated attackers to modify the...

CVE-2023-6197

CVE-2023-6197 affects the Audio Merchant WordPress plugin (versions ≤ 5.0.4). The issue is Cross-Site Request Forgery caused by missing or incorrect nonce validation in audio_merchant_save_settings, enabling unauthenticated attackers to modify plugin settings and inject scripts via forged request...

CVE-2023-6197

The Audio Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0.4. This is due to missing or incorrect nonce validation on the audiomerchantsavesettings function. This makes it possible for unauthenticated attackers to modify the...

CVE-2023-6196 Audio Merchant <= 5.0.4 - Cross-Site Request Forgery to Arbitrary File Upload

The Audio Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0.4. This is due to missing or incorrect nonce validation on the function audiomerchantaddaudiofile function. This makes it possible for unauthenticated attackers to upload...

CVE-2023-6196 Audio Merchant <= 5.0.4 - Cross-Site Request Forgery to Arbitrary File Upload

The Audio Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0.4. This is due to missing or incorrect nonce validation on the function audiomerchantaddaudiofile function. This makes it possible for unauthenticated attackers to upload...

PT-2023-32562 · WordPress · Audio Merchant

Name of the Vulnerable Software and Affected Versions: The Audio Merchant plugin for WordPress versions up to, and including, 5.0.4 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the audio merchant add audio file function. This allo...

PT-2023-32563 · WordPress · Audio Merchant

Name of the Vulnerable Software and Affected Versions: The Audio Merchant plugin for WordPress versions up to, and including, 5.0.4 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the audio merchant save settings function. This allow...

CVE-2023-4689

The Elementor Addon Elements plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.12.7. This is due to missing or incorrect nonce validation on the eaesaveelements function. This makes it possible for unauthenticated attackers to enable/disable...

CVE-2023-4690

The Elementor Addon Elements plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.12.7. This is due to missing or incorrect nonce validation on the eaesaveconfig function. This makes it possible for unauthenticated attackers to change configuration...

CVE-2023-4689

The Elementor Addon Elements plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.12.7. This is due to missing or incorrect nonce validation on the eaesaveelements function. This makes it possible for unauthenticated attackers to enable/disable...

Cross site request forgery (csrf)

The Elementor Addon Elements plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.12.7. This is due to missing or incorrect nonce validation on the eaesaveelements function. This makes it possible for unauthenticated attackers to enable/disable...

CVE-2023-4690 Elementor Addon Elements <= 1.12.7 - Cross-Site Request Forgery

The Elementor Addon Elements plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.12.7. This is due to missing or incorrect nonce validation on the eaesaveconfig function. This makes it possible for unauthenticated attackers to change configuration...

CVE-2023-4689 Elementor Addon Elements <= 1.12.7 - Cross-Site Request Forgery

The Elementor Addon Elements plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.12.7. This is due to missing or incorrect nonce validation on the eaesaveelements function. This makes it possible for unauthenticated attackers to enable/disable...

CVE-2023-4689 Elementor Addon Elements <= 1.12.7 - Cross-Site Request Forgery

The Elementor Addon Elements plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.12.7. This is due to missing or incorrect nonce validation on the eaesaveelements function. This makes it possible for unauthenticated attackers to enable/disable...

WordPress WPC Smart Wishlist for WooCommerce Plugin < 4.7.2 CSRF Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wpclever:wpcsmartwishlistforwoocommerce"; ifdescription...

Email Templates < 1.4.3 - Email Sending via CSRF

Description The plugin is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.2. This is due to missing or incorrect nonce validation on the sendtestemail function. This makes it possible for unauthenticated attackers to send test emails via a forged request granted the...

CVE-2023-5982

The UpdraftPlus: WordPress Backup & Migration Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.23.10. This is due to a lack of nonce validation and insufficient validation of the instanceid on the 'updraftmethod-googledrive-auth' acti...