CVE-2024-6309 Attachment File Icons (AF Icons) <= 1.3 - Cross-Site Request Forgery to Arbitrary File Upload

The Attachment File Icons AF Icons plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 1.3. This is due to missing nonce validation in the 'afioverview' function and missing file type validation in the 'uploadicons' function...

CVE-2024-6309 Attachment File Icons (AF Icons) <= 1.3 - Cross-Site Request Forgery to Arbitrary File Upload

The Attachment File Icons AF Icons plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 1.3. This is due to missing nonce validation in the 'afioverview' function and missing file type validation in the 'uploadicons' function...

CVE-2024-6317 Generate PDF using Contact Form 7 <= 4.1.2 - Cross-Site Request Forgery to Arbitrary File Deletion

The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 4.1.2. This is due to missing nonce validation and the plugin not properly validating a file or its path prior to deleting it in the...

CVE-2024-6316

CVE-2024-6316 affects the WordPress plugin Generate PDF using Contact Form 7, up to version 4.0.6. The vulnerability is due to missing nonce validation and missing file type validation in the wp_cf7_pdf_dashboard_html_page function, enabling CSRF to Arbitrary File Upload. This could allow unauthe...

CVE-2024-6316 Generate PDF using Contact Form 7 <= 4.0.6 - Cross-Site Request Forgery to Arbitrary File Upload

The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 4.0.6. This is due to missing nonce validation and missing file type validation in the 'wpcf7pdfdashboardhtmlpage' function. This makes...

CVE-2024-6317 Generate PDF using Contact Form 7 <= 4.1.2 - Cross-Site Request Forgery to Arbitrary File Deletion

The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 4.1.2. This is due to missing nonce validation and the plugin not properly validating a file or its path prior to deleting it in the...

CVE-2024-6316 Generate PDF using Contact Form 7 <= 4.1.2 - Cross-Site Request Forgery to Arbitrary File Upload

The Generate PDF using Contact Form 7 plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 4.1.2. This is due to missing nonce validation and missing file type validation in the 'wpcf7pdfdashboardhtmlpage' function. This makes...

CVE-2024-6317

CVE-2024-6317 affects the Generate PDF using Contact Form 7 plugin for WordPress. The WordPress plugin is vulnerable to Cross-Site Forgery Request (CSRF) enabling Arbitrary File Deletion in versions up to 4.0.6 due to missing nonce validation and improper file/path validation in wp_cf7_pdf_dashbo...

PT-2024-37541 · WordPress · Cg Scroll To Top

Name of the Vulnerable Software and Affected Versions: ScrollTo Top plugin for WordPress versions up to, and including, 1.2.2 Description: The issue is due to missing nonce validation and missing file type validation in the options page function, making it possible for unauthenticated attackers t...

PT-2024-37542 · WordPress · Scrollto Bottom

Name of the Vulnerable Software and Affected Versions: ScrollTo Bottom plugin for WordPress versions up to, and including, 1.1.1 Description: The issue is due to missing nonce validation and missing file type validation in the options page function, making it possible for unauthenticated attacker...

PT-2024-37531 · WordPress · Advanced Ajax Page Loader

Name of the Vulnerable Software and Affected Versions: Advanced AJAX Page Loader plugin for WordPress versions up to, and including, 2.7.7 Description: The issue is due to missing nonce validation in the admin init AAPL function and missing file type validation in the AAPL options validate...

PT-2024-29200 · WordPress · Pricing Table

Name of the Vulnerable Software and Affected Versions: Pricing Table plugin for WordPress versions up to, and including, 2.0.1 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the ajax function. This allows unauthenticated attackers t...

PT-2024-37537 · WordPress · Generate Pdf Using Contact Form 7

Name of the Vulnerable Software and Affected Versions: Generate PDF using Contact Form 7 plugin for WordPress versions up to, and including, 4.0.6 Description: The issue is due to missing nonce validation and missing file type validation in the wp cf7 pdf dashboard html page function, making it...

CVE-2024-5943

The Nested Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.7. This is due to missing or incorrect nonce validation on the 'settingsPage' function and missing santization of the 'tab' parameter. This makes it possible for...

CVE-2024-5943

CVE-2024-5943 — The Nested Pages WordPress plugin is vulnerable to Cross-Site Request Forgery in all versions up to 3.2.7. The issue arises from missing or incorrect nonce validation in the settingsPage function and missing sanitization of the tab parameter. This allows unauthenticated attackers ...

PT-2024-37258 · WordPress · Nested Pages

Name of the Vulnerable Software and Affected Versions: Nested Pages plugin for WordPress versions up to, and including, 3.2.7 Description: The issue is due to missing or incorrect nonce validation on the settingsPage function and missing sanitization of the tab parameter. This makes it possible f...

CVE-2024-4543

The Snippet Shortcodes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.1.4. This is due to missing or incorrect nonce validation when adding or editing shortcodes. This makes it possible for unauthenticated attackers to modify shortcodes vi...

CVE-2024-4543

The Snippet Shortcodes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.1.4. This is due to missing or incorrect nonce validation when adding or editing shortcodes. This makes it possible for unauthenticated attackers to modify shortcodes vi...

CVE-2024-4543 Snippet Shortcodes <= 4.1.4 - Cross-Site Request Forgery

The Snippet Shortcodes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.1.4. This is due to missing or incorrect nonce validation when adding or editing shortcodes. This makes it possible for unauthenticated attackers to modify shortcodes vi...

CVE-2024-6405

The Floating Social Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the floatingsocialbuttonsoption function. This makes it possible for unauthenticated attackers to update...