Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Settings
Sign in
🔥 Daily Hot!
💪🏽 CPE Enhanced Advisories
🕶 Shadow Exploits
🕵🏼 Vulners CPE
🔐 Security news
💻 Exploit updates
📑 Blogs review
🐧 Linux vulnerabilities
🐞 Bugbounty
🤖 AI High Score
📰 CVE Feed
show all

9420 matches found

Cvelist
Cvelist•added 2025/02/18 5:22 a.m.•21 views

CVE-2024-13438 SpeedSize Image & Video AI-Optimizer <= 1.5.1 - Cross-Site Request Forgery to Clear Cache

The SpeedSize Image & Video AI-Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.1. This is due to missing or incorrect nonce validation on the 'speedsizeclearcsscacheaction' function. This makes it possible for unauthenticated...

4.3CVSS0.00161EPSS
SaveExploits0References2
NVD
NVD•added 2025/02/18 5:15 a.m.•21 views

CVE-2025-0796

The Mortgage Lead Capture System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.2.11. This is due to missing or incorrect nonce validation on the 'wprequalresetdefaults' action. This makes it possible for unauthenticated attackers to reset...

4.3CVSS0.00192EPSS
SaveExploits0References3
OSV
OSV•added 2025/02/18 5:15 a.m.•6 views

CVE-2025-0796

The Mortgage Lead Capture System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.2.10. This is due to missing or incorrect nonce validation on the 'wprequalresetdefaults' action. This makes it possible for unauthenticated attackers to reset...

4.3CVSS7.2AI score0.00192EPSS
SaveExploits0References2
NVD
NVD•added 2025/02/18 5:15 a.m.•21 views

CVE-2024-13852

The Option Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing nonce validation on the pluginpage function. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forged request, grant...

8.8CVSS0.00274EPSS
SaveExploits0References3
OSV
OSV•added 2025/02/18 5:15 a.m.•12 views

CVE-2024-13684

The Reset plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing or incorrect nonce validation on the resetdbpage function. This makes it possible for unauthenticated attackers to reset several tables in the database like...

8.1CVSS7.2AI score0.00216EPSS
SaveExploits0References2
NVD
NVD•added 2025/02/18 5:15 a.m.•23 views

CVE-2024-13684

The Reset plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing or incorrect nonce validation on the resetdbpage function. This makes it possible for unauthenticated attackers to reset several tables in the database like...

8.1CVSS0.00216EPSS
SaveExploits0References2
NVD
NVD•added 2025/02/18 5:15 a.m.•31 views

CVE-2024-13555

The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or incorrect nonce validation on the cancelactions function. This makes it possible for...

5.3CVSS0.00198EPSS
SaveExploits0References3
NVD
NVD•added 2025/02/18 5:15 a.m.•32 views

CVE-2024-13522

The magayo Lottery Results plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.12. This is due to missing or incorrect nonce validation on the 'magayo-lottery-results' page. This makes it possible for unauthenticated attackers to update...

6.1CVSS0.00164EPSS
SaveExploits0References2
OSV
OSV•added 2025/02/18 5:15 a.m.•9 views

CVE-2024-13522

The magayo Lottery Results plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.12. This is due to missing or incorrect nonce validation on the 'magayo-lottery-results' page. This makes it possible for unauthenticated attackers to update...

5.4CVSS7.2AI score0.00164EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment•added 2025/02/18 4:21 a.m.•14 views

CVE-2024-13555 1 Click WordPress Migration Plugin – 100% FREE for a limited time <= 2.2 - Cross-Site Request Forgery to Backup Process Cancellation

The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or incorrect nonce validation on the cancelactions function. This makes it possible for...

5.3CVSS6.6AI score0.00198EPSS
SaveExploits0References3
CVE
CVE•added 2025/02/18 4:21 a.m.•61 views

CVE-2024-13555

CVE-2024-13555 – The 1 Click WordPress Migration Plugin (up to v2.1) is vulnerable to Cross-Site Request Forgery due to missing/incorrect nonce validation in cancel_actions(). This can allow unauthenticated attackers to cancel a backup triggered by a site administrator via a forged request. No pu...

5.3CVSS6.6AI score0.00198EPSS
SaveExploits0References3Affected Software1
CVE
CVE•added 2025/02/18 4:21 a.m.•71 views

CVE-2024-13852

CVE-2024-13852 affects the WordPress plugin Option Editor (version 1.0). The root cause is missing nonce validation in the plugin_page() function, enabling CSRF. This allows unauthenticated attackers to forge requests to update arbitrary site options, potentially setting the default registration ...

8.8CVSS7AI score0.00274EPSS
SaveExploits0References3Affected Software1
Cvelist
Cvelist•added 2025/02/18 4:21 a.m.•18 views

CVE-2024-13852 Option Editor <= 1.0 - Cross-Site Request Forgery to Arbitrary Options Update

The Option Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing nonce validation on the pluginpage function. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forged request, grant...

8.8CVSS0.00274EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment•added 2025/02/18 4:21 a.m.•11 views

CVE-2024-13852 Option Editor <= 1.0 - Cross-Site Request Forgery to Arbitrary Options Update

The Option Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing nonce validation on the pluginpage function. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forged request, grant...

8.8CVSS6.9AI score0.00274EPSS
SaveExploits0References3
CVE
CVE•added 2025/02/18 4:21 a.m.•79 views

CVE-2025-0796

CVE-2025-0796 (Mortgage Lead Capture System for WordPress, WPrequal) is a CSRF vulnerability caused by missing nonce validation in the wprequal_reset_defaults action, affecting versions up to 8.2.10. Wordfence notes the issue and confirms a patched fix in 8.2.11. Public exploitation details are n...

4.3CVSS7.2AI score0.00192EPSS
SaveExploits0References3Affected Software1
Cvelist
Cvelist•added 2025/02/18 4:21 a.m.•22 views

CVE-2025-0796 Mortgage Lead Capture System <= 8.2.11 - Cross-Site Request Forgery to Settings Reset

The Mortgage Lead Capture System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.2.11. This is due to missing or incorrect nonce validation on the 'wprequalresetdefaults' action. This makes it possible for unauthenticated attackers to reset...

4.3CVSS0.00192EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment•added 2025/02/18 4:21 a.m.•8 views

CVE-2025-0796 Mortgage Lead Capture System <= 8.2.11 - Cross-Site Request Forgery to Settings Reset

The Mortgage Lead Capture System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.2.11. This is due to missing or incorrect nonce validation on the 'wprequalresetdefaults' action. This makes it possible for unauthenticated attackers to reset...

4.3CVSS7.2AI score0.00192EPSS
SaveExploits0References3
CVE
CVE•added 2025/02/18 4:21 a.m.•56 views

CVE-2024-13684

CVE-2024-13684 (Reset plugin for WordPress) has a CSRF vulnerability present in all versions up to 1.6 due to missing nonce validation on reset_db_page(); unauthenticated attackers could cause the site administrator to trigger database resets, affecting tables such as comments, themes, plugins, e...

8.1CVSS6.5AI score0.00216EPSS
SaveExploits0References2Affected Software1
Vulnrichment
Vulnrichment•added 2025/02/18 4:21 a.m.•9 views

CVE-2024-13684 Reset <= 1.6 - Cross-Site Request Forgery to Database Reset

The Reset plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing or incorrect nonce validation on the resetdbpage function. This makes it possible for unauthenticated attackers to reset several tables in the database like...

8.1CVSS7.8AI score0.00216EPSS
SaveExploits0References2
Cvelist
Cvelist•added 2025/02/18 4:21 a.m.•29 views

CVE-2024-13684 Reset <= 1.6 - Cross-Site Request Forgery to Database Reset

The Reset plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing or incorrect nonce validation on the resetdbpage function. This makes it possible for unauthenticated attackers to reset several tables in the database like...

8.1CVSS0.00216EPSS
SaveExploits0References2
Rows per page
Query Builder