PT-2023-12505 · WordPress · Ecommerce Product Catalog Plugin

Name of the Vulnerable Software and Affected Versions: eCommerce Product Catalog Plugin for WordPress versions up to, and including, 3.0.17 Description: The issue is due to missing or incorrect nonce validation on the save function, making it possible for unauthenticated attackers to save manual...

PT-2023-11888 · WordPress · Dokan

Name of the Vulnerable Software and Affected Versions: Dokan plugin for WordPress versions up to, and including, 3.0.8 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the handle order export function. This allows unauthenticated...

PT-2023-11883 · WordPress · Product Catalog Simple

Name of the Vulnerable Software and Affected Versions: Product Catalog Simple plugin for WordPress versions up to, and including, 1.5.13 Description: The issue is due to missing or incorrect nonce validation on the implecode save products meta function, making it possible for unauthenticated...

PT-2023-12514 · WordPress · Hm Multiple Roles

Name of the Vulnerable Software and Affected Versions: Multiple Roles plugin for WordPress versions up to, and including, 1.3.1 Description: The issue is due to missing or incorrect nonce validation on the mu add roles in signup meta and mu add roles in signup meta recently functions. This allows...

PT-2023-12509 · WordPress · Staff Directory Plugin

Name of the Vulnerable Software and Affected Versions: Staff Directory Plugin versions up to, and including, 3.6 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the saveCustomFields function. This allows unauthenticated attackers to...

PT-2023-11882 · WordPress · Custom Field Template

Name of the Vulnerable Software and Affected Versions: Custom Field Template plugin for WordPress versions up to, and including, 2.5.1 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the edit meta value function. This allows...

PT-2023-11876 · Cartflows · Woocommerce Checkout & Funnel Builder By Cartflows

Name of the Vulnerable Software and Affected Versions: WooCommerce Checkout & Funnel Builder by CartFlows plugin for WordPress versions up to, and including, 1.5.15 Description: The issue is due to missing or incorrect nonce validation on the export json, import json, and status logs file...

PT-2023-11887 · WordPress · Lightweight Sidebar Manager

Name of the Vulnerable Software and Affected Versions: Lightweight Sidebar Manager plugin for WordPress versions up to, and including, 1.1.4 Description: The issue is due to missing or incorrect nonce validation on the metabox save function, making it possible for unauthenticated attackers to sav...

PT-2023-12504 · WordPress · Ecommerce Product Catalog Plugin

Name of the Vulnerable Software and Affected Versions: eCommerce Product Catalog Plugin for WordPress versions up to, and including, 2.9.43 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the implecode save products meta function. Th...

PT-2023-11889 · WordPress · Easy Testimonials

Name of the Vulnerable Software and Affected Versions: Easy Testimonials plugin for WordPress versions up to and including 3.6.1 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the saveCustomFields function. This allows unauthenticat...

PT-2023-11875 · WordPress · Wp Erp

Name of the Vulnerable Software and Affected Versions: WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress versions up to, and including, 1.6.3 Description: The issue is due to missing or incorrect nonce validation on the handle leave...

PT-2023-12506 · WordPress · Locations

Name of the Vulnerable Software and Affected Versions: Locations plugin for WordPress versions up to, and including, 3.2.1 Description: The issue is due to missing or incorrect nonce validation on the saveCustomFields function, making it possible for unauthenticated attackers to update custom fie...

PT-2023-12496 · WordPress · The Wordpress Photo Gallery – Image Gallery

Name of the Vulnerable Software and Affected Versions: The WordPress Photo Gallery – Image Gallery plugin for WordPress versions up to, and including, 1.0.6 Description: The issue is due to missing or incorrect nonce validation on the load images thumbnail and edit gallery functions, making it...

Cross site request forgery (csrf)

The Subscribe2 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.40. This is due to missing or incorrect nonce validation when sending test emails. This makes it possible for unauthenticated attackers to send test emails with custom content to...

CVE-2023-3407 Subscribe2 <= 10.40 - Cross-Site Request Forgery

The Subscribe2 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.40. This is due to missing or incorrect nonce validation when sending test emails. This makes it possible for unauthenticated attackers to send test emails with custom content to...

CVE-2023-3427

The Salon Booking System plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.6. This is due to missing or incorrect nonce validation on the 'savecustomer' function. This makes it possible for unauthenticated attackers to change the admin role to...

CVE-2023-3427

The Salon Booking System plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.6. This is due to missing or incorrect nonce validation on the 'savecustomer' function. This makes it possible for unauthenticated attackers to change the admin role to...

CVE-2023-3427 Salon Booking System <= 8.4.6 - Cross-Site Request Forgery to Admin Role Change to Customer, User Meta Update via save_customer

The Salon Booking System plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.6. This is due to missing or incorrect nonce validation on the 'savecustomer' function. This makes it possible for unauthenticated attackers to change the admin role to...

CVE-2023-3427 Salon Booking System <= 8.4.6 - Cross-Site Request Forgery to Admin Role Change to Customer, User Meta Update via save_customer

The Salon Booking System plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.6. This is due to missing or incorrect nonce validation on the 'savecustomer' function. This makes it possible for unauthenticated attackers to change the admin role to...

PT-2023-24658 · WordPress · Subscribe2

Name of the Vulnerable Software and Affected Versions: Subscribe2 plugin for WordPress versions up to, and including, 10.40 Description: The issue is due to missing or incorrect nonce validation when sending test emails, making it possible for unauthenticated attackers to send test emails with...