CVE-2024-2113

The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.0. This is due to missing or incorrect nonce validation on the nfdownloadallsubs AJAX action. This makes it possib...

CVE-2024-2113

The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.0. This is due to missing or incorrect nonce validation on the nfdownloadallsubs AJAX action. This makes it possib...

CVE-2024-2964

The Pocket News Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.0. This is due to missing or incorrect nonce validation on the optionpage function. This makes it possible for unauthenticated attackers to update the plugin's...

CVE-2024-2964

CVE-2024-2964 affects the Pocket News Generator WordPress plugin. The Red Hat entry confirms a CSRF vulnerability in all versions up to 0.2.0 caused by missing/incorrect nonce validation in option_page(). This enables unauthenticated attackers to update plugin settings via a forged request if a s...

CVE-2024-2113

CVE-2024-2113 affects Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress up to version 3.8.0. The vulnerability arises from missing or incorrect nonce validation on the nf_download_all_subs AJAX action, enabling unauthenticated attackers to trigger exporting a form’s submissi...

CVE-2024-2969 WP-Eggdrop <= 0.1 - Cross-Site Request Forgery to Settings Update

The WP-Eggdrop plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1. This is due to missing or incorrect nonce validation on the wpeggupdateOptions function. This makes it possible for unauthenticated attackers to update the plugin's settings...

CVE-2024-2970

The CVE CVE-2024-2970 affects the News Wall WordPress plugin (all versions up to 1.1.0). It is a Cross-Site Request Forgery vulnerability caused by missing or incorrect nonce validation in the nwap_newslist_page() function. This enables unauthenticated attackers to update the plugin’s settings an...

CVE-2024-2969

CVE-2024-2969 affects the WP-Eggdrop WordPress plugin (all versions up to 0.1). It is a CSRF flaw caused by missing/incorrect nonce validation in wpegg_updateOptions(), allowing unauthenticated attackers to trigger plugin setting updates via forged requests if a site admin is induced to perform a...

CP Media Player < 1.2.0 - Player Deletion and Duplication via CSRF

Description The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on the adminpage function. This makes it possible for unauthenticated attackers to delete or duplicate existing audio or video players via a forged request granted they can trick a site...

CVE-2024-2110

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.4.7.1. This is due to missing or incorrect nonce validation on several actions. This makes it possible for unauthenticated attackers...

CVE-2024-2110

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.4.7.1. This is due to missing or incorrect nonce validation on several actions. This makes it possible for unauthenticated attackers...

CVE-2024-2110 Events Manager <= 6.4.7.1 - Cross-Site Request Forgery

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.4.7.1. This is due to missing or incorrect nonce validation on several actions. This makes it possible for unauthenticated attackers...

CVE-2024-2110

The CVE-2024-2110 issue affects the WordPress plugin Events Manager – Calendar, Bookings, Tickets, and more! The Red Hat and Wordfence references confirm a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to 6.4.7.1 due to missing/incorrect nonce validation on multiple actions. ...

PT-2024-18833 · WordPress · Ninja Forms Contact Form

Name of the Vulnerable Software and Affected Versions: The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress versions up to, and including, 3.8.0 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation...

BizPrint < 4.5.6 - Cross-Site Request Forgery to Cross-Site Scripting via process.php

Description The BizPrint plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.5. This is due to missing or incorrect nonce validation in the process.php file. This makes it possible for unauthenticated attackers to generate invoices containing...

PT-2024-22964 · WordPress · The News Wall

Name of the Vulnerable Software and Affected Versions: The News Wall plugin for WordPress versions up to, and including, 1.1.0 Description: The issue is due to missing or incorrect nonce validation on the nwap newslist page function, making it possible for unauthenticated attackers to update the...

PT-2024-22944 · WordPress · Pocket News Generator

Name of the Vulnerable Software and Affected Versions: The Pocket News Generator plugin for WordPress versions up to, and including, 0.2.0 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the option page function. This allows...

WP-Eggdrop <= 0.1 - Cross-Site Request Forgery to Settings Update

Description The WP-Eggdrop plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1. This is due to missing or incorrect nonce validation on the wpeggupdateOptions function. This makes it possible for unauthenticated attackers to update the plugin...

News Wall <= 1.1.0 - Cross-Site Request Forgery to Plugin Settings Update

Description The News Wall plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing or incorrect nonce validation on the nwapnewslistpage function. This makes it possible for unauthenticated attackers to update the plugin'...

PT-2024-22963 · WordPress · Wp-Eggdrop

Name of the Vulnerable Software and Affected Versions: WP-Eggdrop plugin for WordPress versions up to, and including, 0.1 Description: The issue is related to a Cross-Site Request Forgery vulnerability due to missing or incorrect nonce validation in the wpegg updateOptions function. This allows...