CVE-2024-12003

The WP System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to missing or incorrect nonce validation on the generatewpsystempagecontent function. This makes it possible for unauthenticated attackers to inject malicious we...

CVE-2024-11336

The Clickbank WordPress Plugin Storefront plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7. This is due to missing or incorrect nonce validation via the csmenu page. This makes it possible for unauthenticated attackers to update settings a...

CVE-2024-11444

The CLUEVO LMS, E-Learning Platform plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.13.2. This is due to missing or incorrect nonce validation on the cluevorendermoduleui function. This makes it possible for unauthenticated attackers to...

CVE-2024-11336

CVE-2024-11336 affects the Clickbank WordPress Plugin (Storefront) for WordPress, version

CVE-2024-11444 CLUEVO LMS, E-Learning Platform <= 1.13.2 - Cross-Site Request Forgery to Module Deletion

The CLUEVO LMS, E-Learning Platform plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.13.2. This is due to missing or incorrect nonce validation on the cluevorendermoduleui function. This makes it possible for unauthenticated attackers to...

CVE-2024-11444

CVE-2024-11444 : CLUEVO LMS (WordPress plugin)

CVE-2024-12003 WP System <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The WP System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to missing or incorrect nonce validation on the generatewpsystempagecontent function. This makes it possible for unauthenticated attackers to inject malicious we...

CVE-2024-12003 WP System <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The WP System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to missing or incorrect nonce validation on the generatewpsystempagecontent function. This makes it possible for unauthenticated attackers to inject malicious we...

CVE-2024-12003

The CVE-2024-12003 entry concerns the WP System WordPress plugin (versions up to 1.1.1). The advisory states a Cross-Site Request Forgery (CSRF) vulnerability due to missing or incorrect nonce validation in generate_wp_system_page_content(), enabling unauthenticated attackers to inject malicious ...

PT-2024-17397 · WordPress · Wp System

Name of the Vulnerable Software and Affected Versions: WP System plugin for WordPress versions up to, and including, 1.1.1 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the generate wp system page content function. This allows...

PT-2024-16998 · WordPress · Cluevo Lms

Name of the Vulnerable Software and Affected Versions: CLUEVO LMS, E-Learning Platform plugin for WordPress versions up to, and including, 1.13.2 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the cluevo render module ui function...

CVE-2024-11341 Simple Redirection <= 1.5 - Cross-Site Request Forgery to Arbitrary Site Redirect

The Simple Redirection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the settingspage function. This makes it possible for unauthenticated attackers to update the plugin's setting...

PT-2024-16923 · WordPress · Simple Redirection

Name of the Vulnerable Software and Affected Versions: Simple Redirection plugin for WordPress versions up to, and including, 1.5 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the settings page function. This allows unauthenticated...

CVE-2024-10832

The Posti Shipping plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the accountnumber and secretkey parameters in all versions up to, and including, 3.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2024-10832

CVE-2024-10832 : Posti Shipping plugin for WordPress (versions ≤ 3.10.3) is vulnerable to Cross-Site Request Forgery due to missing/incorrect nonce validation in generate_notices_html. This CSRF can allow unauthenticated attackers to trigger actions that lead to stored XSS by convincing an admini...

WordPress FloristPress plugin <= 7.3.0 - Nonce Leakage to Broken Access Control vulnerability

Nonce Leakage to Broken Access Control vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin FloristPress versions = 7.3.0...

CVE-2024-10521

The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.2. This is due to missing or incorrect nonce validation on the processbulkaction function. This makes it possible for unauthenticated attackers to dele...

CVE-2024-10521

The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.2. This is due to missing or incorrect nonce validation on the processbulkaction function. This makes it possible for unauthenticated attackers to dele...

CVE-2024-10521 WordPress Contact Forms by Cimatti <= 1.9.2 - Cross-Site Request Forgery via process_bulk_action Function

The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.2. This is due to missing or incorrect nonce validation on the processbulkaction function. This makes it possible for unauthenticated attackers to dele...

CVE-2024-10521 WordPress Contact Forms by Cimatti <= 1.9.2 - Cross-Site Request Forgery via process_bulk_action Function

The WordPress Contact Forms by Cimatti plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.2. This is due to missing or incorrect nonce validation on the processbulkaction function. This makes it possible for unauthenticated attackers to dele...