Digital Publications by Supsystic < 1.7.8 - Cross-Site Request Forgery

Description The WordPress Flipbook by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.7. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perfor...

Download IP2Location Country Blocker < 2.34.3 - Cross-Site Request Forgery

Description The Download IP2Location Country Blocker plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.34.2. This is due to missing or incorrect nonce validation on the validateapikey function. This makes it possible for unauthenticated attackers...

WP Client Reports < 1.0.23 - Cross-Site Request Forgery

Description The WP Client Reports plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.22. This is due to missing or incorrect nonce validation on the wpclientreportssendemailreportfromajax function. This makes it possible for unauthenticated...

Zoho Campaigns < 2.0.8 - Cross-Site Request Forgery via zcwc_integration_disconnect

Description The Zoho Campaigns plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.7. This is due to missing or incorrect nonce validation on the zcwcintegrationdisconnect function. This makes it possible for unauthenticated attackers to disconne...

Before And After <= 3.9 - Cross-Site Request Forgery

Description The Before And After plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.9. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a...

BEAF < 4.5.5 - Cross-Site Request Forgery to Notice Dismissal

Description The BEAF plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.4. This is due to missing or incorrect nonce validation on the bafgnewfeaturenoticedismissed function. This makes it possible for unauthenticated attackers to dismiss notice...

Legal Pages < 1.4.3 - Cross-Site Request Forgery

Description The Legal Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.2. This is due to missing or incorrect nonce validation on the uninstallreasonsubmission function. This makes it possible for unauthenticated attackers to submit an...

WpTravelly < 1.6.1 - Cross-Site Request Forgery

Description The WpTravelly plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.0. This is due to missing or incorrect nonce validation on the quicksetup function. This makes it possible for unauthenticated attackers to trigger a set-up via a forg...

AWP Classifieds < 4.3.2 - Cross-Site Request Forgery

Description The AWP Classifieds plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.3.1. This is due to missing or incorrect nonce validation on the ajax function. This makes it possible for unauthenticated attackers to edit balances via a forged...

AffiEasy < 1.1.6 - Cross-Site Request Forgery

Description The AffiEasy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.4. This is due to missing or incorrect nonce validation on the delete-table action. This makes it possible for unauthenticated attackers to delete tables via a forged...

Inline Related Posts < 3.4.0 - Tracking Toggle via CSRF

Description The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on the managertrackingOn and managertrackingOff functions. This makes it possible for unauthenticated attackers to turn tracking on and off via a forged request granted they can trick a...

WebinarIgnition < 3.06.0 - Cross-Site Request Forgery

Description The WebinarIgnition plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.05.8. This is due to missing or incorrect nonce validation on the delete action. This makes it possible for unauthenticated attackers to delete settings via a forge...

eCommerce Product Catalog < 3.3.29 - Cross-Site Request Forgery

Description The eCommerce Product Catalog plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3.28. This is due to missing or incorrect nonce validation on the handlemode function. This makes it possible for unauthenticated attackers to change mode...

MultiParcels Shipping For WooCommerce < 1.16.9 - Cross-Site Request Forgery

Description The MultiParcels Shipping For WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to 1.16.9 exclusive. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perfo...

Leadinfo < 1.1 - Settings Update via CSRF

Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

GEO my WordPress < 4.2 - Cross-Site Request Forgery

Description The GEO my WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform unauthorized actions via a...

Siteimprove < 2.0.7 - Cross-Site Request Forgery

Description The Siteimprove plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.6. This is due to missing or incorrect nonce validation on two functions. This makes it possible for unauthenticated attackers to request a token via a forged request...

PuTTY < 0.81 Key Recovery Attack Vulnerability

In PuTTY 0.68 through 0.80 before 0.81, biased ECDSA nonce generation allows an attacker to recover a user's NIST P-521 secret key via a quick attack in approximately 60 signatures. This is especially important in a scenario where an adversary is able to read messages signed by PuTTY or Pageant...

MihanPanel < 12.7 - Cross-Site Request Forgery

Description The MihanPanel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to 12.7. This is due to missing or incorrect nonce validation on the delete and deleteall cases. This makes it possible for unauthenticated attackers to delete IP addresses from the blocked...

Extra Product Options Builder for WooCommerce < 1.2.105 - Cross-Site Request Forgery to Notice Dismissal

Description The Extra Product Options Builder for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.104. This is due to missing or incorrect nonce validation on the DontShowAgain function. This makes it possible for unauthenticated...