CVE-2021-4410

CVE-2021-4410 — Qtranslate Slug (WordPress) CSRF : The Qtranslate Slug plugin is vulnerable through version 1.1.18 due to missing/incorrect nonce validation in the save_postdata() function, enabling unauthenticated attackers to save post data via forged requests if a site admin visits a malicious...

CVE-2021-4409 WooCommerce Etsy Integration <= 3.3.1 - Cross-Site Request Forgery Bypass

The WooCommerce Etsy Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3.1. This is due to missing or incorrect nonce validation on the etcpfdeletefeed function. This makes it possible for unauthenticated attackers to delete an export...

CVE-2021-4409 WooCommerce Etsy Integration <= 3.3.1 - Cross-Site Request Forgery Bypass

The WooCommerce Etsy Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3.1. This is due to missing or incorrect nonce validation on the etcpfdeletefeed function. This makes it possible for unauthenticated attackers to delete an export...

CVE-2021-4408 DW Question & Answer <= 1.5.8 - Cross-Site Request Forgery Bypass

The DW Question & Answer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.8. This is due to missing or incorrect nonce validation on the updateanswer function. This makes it possible for unauthenticated attackers to update answers to questions...

CVE-2020-36750 EWWW Image Optimizer <= 5.8.1 - Cross-Site Request Forgery Bypass

The EWWW Image Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.8.1. This is due to missing or incorrect nonce validation on the ewwwnggbulkinit function. This makes it possible for unauthenticated attackers to perform bulk image...

CVE-2021-4407

The Custom Banners plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.2 This is due to missing or incorrect nonce validation on the saveCustomFields function. This makes it possible for unauthenticated attackers to save custom fields via a forge...

CVE-2020-36750

The CVE-2020-36750 entry concerns the WordPress EWWW Image Optimizer plugin. Affected component: ewww_ngg_bulk_init() function in versions up to and including 5.8.1. Root cause: insufficient nonce validation leads to a Cross-Site Request Forgery (CSRF). Impact: unauthenticated attackers could tri...

PT-2023-12539 · WordPress · Absolute Reviews

Name of the Vulnerable Software and Affected Versions: Absolute Reviews plugin for WordPress versions up to, and including, 1.0.8 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the metabox review save function. This allows...

PT-2023-12529 · WordPress · The Forminator Forms

Name of the Vulnerable Software and Affected Versions: The Forminator – Contact Form, Payment Form & Custom Form Builder plugin for WordPress versions up to, and including, 1.13.4 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the...

PT-2023-12520 · WordPress · Dw Question & Answer Pro

Name of the Vulnerable Software and Affected Versions: DW Question & Answer plugin for WordPress versions up to, and including, 1.5.8 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the update answer function. This allows...

PT-2023-12527 · WordPress · Sunshine Photo Cart

Name of the Vulnerable Software and Affected Versions: Sunshine Photo Cart plugin for WordPress versions up to, and including, 2.8.28 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the sunshine products quicksave post function. This...

PT-2023-23558 · WordPress · Mstore Api

Name of the Vulnerable Software and Affected Versions: MStore API plugin for WordPress affected versions not specified Description: The issue is related to Cross-Site Request Forgery due to missing nonce validation on the mstore update status order title function. This allows unauthenticated...

PT-2023-12528 · WordPress · Wp-Mpdf

Name of the Vulnerable Software and Affected Versions: wp-mpdf plugin for WordPress versions up to, and including, 3.5.1 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the mpdf admin savepost function. This allows unauthenticated...

PT-2023-12522 · WordPress · Qtranslate Slug

Name of the Vulnerable Software and Affected Versions: Qtranslate Slug plugin for WordPress versions up to and including 1.1.18 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the save postdata function. This allows unauthenticated...

PT-2023-12526 · WordPress · Abandoned Cart Lite For Woocommerce

Name of the Vulnerable Software and Affected Versions: Abandoned Cart Lite for WooCommerce plugin for WordPress versions up to and including 5.8.5 Description: The issue arises from missing or incorrect nonce validation on the wcal preview emails function, allowing unauthenticated attackers to...

PT-2023-12524 · WordPress · Wp Prayer

Name of the Vulnerable Software and Affected Versions: WP Prayer plugin for WordPress versions up to, and including, 1.6.5 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the save and export functions. This allows unauthenticated...

PT-2023-12535 · WordPress · Advanced Popups

Name of the Vulnerable Software and Affected Versions: Advanced Popups plugin for WordPress versions up to, and including, 1.1.1 Description: The issue is due to missing or incorrect nonce validation on the metabox popup save function, making it possible for unauthenticated attackers to save meta...

PT-2023-11892 · WordPress · The Coming Soon Page & Maintenance Mode

Name of the Vulnerable Software and Affected Versions: Coming Soon & Maintenance Mode Page plugin for WordPress versions up to, and including, 1.57 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the save meta box function. This allo...

PT-2023-12523 · WordPress · Wp Easypay – Square

Name of the Vulnerable Software and Affected Versions: WP EasyPay – Square for WordPress plugin versions up to, and including, 3.2.0 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the wpep download transaction in excel function. Thi...

PT-2023-12519 · WordPress · Custom Banners

Name of the Vulnerable Software and Affected Versions: Custom Banners plugin for WordPress versions up to and including 3.2.2 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the saveCustomFields function. This allows unauthenticated...