CVE-2025-2935

The Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2024.7. This is due to missing or incorrect nonce validation in the 'ssoptionmaint.php' and 'ssuserfilterlist' files. This make...

CVE-2025-2935 Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms <= 2024.7 - Cross-Site Request Forgery to Multiple Administrative Actions

The Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2024.7. This is due to missing or incorrect nonce validation in the 'ssoptionmaint.php' and 'ssuserfilterlist' files. This make...

CVE-2025-2935 Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms <= 2024.7 - Cross-Site Request Forgery to Multiple Administrative Actions

The Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2024.7. This is due to missing or incorrect nonce validation in the 'ssoptionmaint.php' and 'ssuserfilterlist' files. This make...

CVE-2025-2935

CVE-2025-2935 (WordPress Wordfence entry confirmed) : The Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to 2024.7. The root cause is missing or incorrect nonce validation in the files ss_option_ma...

CVE-2025-4966

CVE-2025-4966 (WP Online Users Stats, WordPress) is a CSRF vulnerability due to missing nonce validation in hk_dataset_results(). It affects all versions up to 1.0.0. The description states unauthenticated attackers can trick a site administrator into performing actions via forged requests, poten...

CVE-2025-4966 WP Online Users Stats <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via hk_dataset_results Function

The WP Online Users Stats plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation within the hkdatasetresults function. This makes it possible for unauthenticated attackers to inject malicious web script...

CVE-2025-5019

CVE-2025-5019 affects Hive Support (WordPress plugin). The root cause is missing or improper nonce validation in hs_update_ai_chat_settings(), enabling CSRF. This allows unauthenticated attackers to reconfigure the plugin’s AI/chat settings (including API keys) and potentially redirect notificati...

CVE-2025-5019 Hive Support <= 1.2.5 - Cross-Site Request Forgery via hs_update_ai_chat_settings Function

The Hive Support | AI-Powered Help Desk, Live Chat & AI Chat Bot Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.5. This is due to missing or incorrect nonce validation on the hsupdateaichatsettings function. This mak...

CVE-2025-2935: Cross-Site Request Forgery (CSRF)

The Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2024.7. This is due to missing or incorrect nonce validation in the 'ssoptionmaint.php' and 'ssuserfilterlist' files. This make...

PT-2025-24020 · WordPress · Anti-Spam: Spam Protection | Block Spam Users

Name of the Vulnerable Software and Affected Versions: Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms plugin for WordPress versions up to, and including, 2024.7 Description: The issue is due to missing or incorrect nonce validation in the 'ss option maint.php' and 'ss user filter...

CVE-2025-4966: Cross-Site Request Forgery (CSRF)

The WP Online Users Stats plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing nonce validation within the hkdatasetresults function. This makes it possible for unauthenticated attackers to inject malicious web script...

PT-2025-24032 · WordPress · Wp Online Users Stats

Name of the Vulnerable Software and Affected Versions: WP Online Users Stats plugin for WordPress versions up to, and including, 1.0.0 Description: The issue is related to Cross-Site Request Forgery due to missing nonce validation within the hk dataset results function. This allows unauthenticate...

CVE-2025-5142

The Simple Page Access Restriction plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.31. This is due to missing nonce validation and capability checks in the settings save handler in the settings.php script. This makes it possible for...

CVE-2025-5142

The Simple Page Access Restriction plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.31. This is due to missing nonce validation and capability checks in the settings save handler in the settings.php script. This makes it possible for...

CVE-2025-5142

The Simple Page Access Restriction plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.31. This is due to missing nonce validation and capability checks in the settings save handler in the settings.php script. This makes it possible for...

CVE-2025-5142

CVE-2025-5142 : The Simple Page Access Restriction WordPress plugin (versions

CVE-2025-5142 Simple Page Access Restriction <= 1.0.31 - Cross-Site Request Forgery via Multiple Parameters

The Simple Page Access Restriction plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.31. This is due to missing nonce validation and capability checks in the settings save handler in the settings.php script. This makes it possible for...

CVE-2025-5142 Simple Page Access Restriction <= 1.0.31 - Cross-Site Request Forgery via Multiple Parameters

The Simple Page Access Restriction plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.31. This is due to missing nonce validation and capability checks in the settings save handler in the settings.php script. This makes it possible for...

CVE-2025-5142: Cross-Site Request Forgery (CSRF)

The Simple Page Access Restriction plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.31. This is due to missing nonce validation and capability checks in the settings save handler in the settings.php script. This makes it possible for...

PT-2025-23277 · WordPress · Simple Page Access Restriction

Name of the Vulnerable Software and Affected Versions: The Simple Page Access Restriction plugin for WordPress versions up to, and including, 1.0.31 Description: The issue is due to missing nonce validation and capability checks in the settings save handler in the settings.php script. This allows...