CVE-2025-2163 Zoorum Comments <= 0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Zoorum Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9. This is due to missing or incorrect nonce validation on the zoorumsetoptions function. This makes it possible for unauthenticated attackers to update settings and inject...

CVE-2025-1530: Cross-Site Request Forgery (CSRF)

The Tripetto plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.0.9. This is due to missing nonce validation. This makes it possible for unauthenticated attackers to delete arbitrary results via a forged request granted they can trick a site...

CVE-2025-2163: Improper Neutralization of Input During Web Page Generation

The Zoorum Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9. This is due to missing or incorrect nonce validation on the zoorumsetoptions function. This makes it possible for unauthenticated attackers to update settings and inject...

PT-2025-11332

Name of the Vulnerable Software and Affected Versions: Tripetto plugin for WordPress versions up to, and including, 8.0.9 Description: The issue is related to Cross-Site Request Forgery due to missing nonce validation. This allows unauthenticated attackers to delete arbitrary results via a forged...

WordPress plugin Tripetto has a cross-site request forgeing vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site reques...

CVE-2024-13913

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1.0.83. This is due to missing or incorrect nonce validation in the '/migrate/templates/main.php' file. This makes it possible for...

CVE-2025-1764

The LoginPress | wp-login Custom Login Page Customizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.1. This is due to missing or incorrect nonce validation on the 'custompluginsetoption' function. This makes it possible for...

CVE-2024-13913

CVE-2024-13913 (InstaWP Connect – 1-click WP Staging & Migration for WordPress) is a CSRF-to-LFI vulnerability affecting versions up to 0.1.0.83. The root cause is missing or incorrect nonce validation in the file /migrate/templates/main.php, enabling an unauthenticated attacker to coerce the app...

CVE-2024-13913 InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.83 - Cross-Site Request Forgery to Local File Inclusion

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1.0.83. This is due to missing or incorrect nonce validation in the '/migrate/templates/main.php' file. This makes it possible for...

CVE-2025-1764

CVE-2025-1764 affects the WordPress plugin LoginPress (wp-login Custom Login Page Customizer) up to version 3.3.1. Root cause: missing/incorrect nonce validation in custom_plugin_set_option enables CSRF, allowing unauthenticated attackers to forge requests and update arbitrary site options, poten...

CVE-2025-1764 LoginPress <= 3.3.1 - Cross-Site Request Forgery to Arbitrary Options Update

The LoginPress | wp-login Custom Login Page Customizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.1. This is due to missing or incorrect nonce validation on the 'custompluginsetoption' function. This makes it possible for...

CVE-2025-1764 LoginPress <= 3.3.1 - Cross-Site Request Forgery to Arbitrary Options Update

The LoginPress | wp-login Custom Login Page Customizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.1. This is due to missing or incorrect nonce validation on the 'custompluginsetoption' function. This makes it possible for...

CVE-2025-1764: Cross-Site Request Forgery (CSRF)

The LoginPress | wp-login Custom Login Page Customizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.1. This is due to missing or incorrect nonce validation on the 'custompluginsetoption' function. This makes it possible for...

CVE-2024-13913: Cross-Site Request Forgery (CSRF)

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.1.0.83. This is due to missing or incorrect nonce validation in the '/migrate/templates/main.php' file. This makes it possible for...

CVE-2024-13436

The Appsero Helper plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.2. This is due to missing or incorrect nonce validation on the 'appserohelper' page. This makes it possible for unauthenticated attackers to update settings and inject...

CVE-2025-1926

The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.8. This is due to missing or incorrect nonce validation on the pagelayersavepost function. This makes it possible for...

Exploit for Missing Authorization in Xlplugins Finale

CVE-2024-30485 Exploit 📌 Overview CVE-2024-30485 is a...

Exploit for CVE-2025-28915

CVE-2025-28915 - WordPress ThemeEgg ToolKit Arbitrary File Upl...

CVE-2024-13436

The Appsero Helper plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.2. This is due to missing or incorrect nonce validation on the 'appserohelper' page. This makes it possible for unauthenticated attackers to update settings and inject...

CVE-2024-13436

CVE-2024-13436 concerns the WordPress plugin Appsero Helper. The connected documents confirm a Cross-Site Request Forgery (CSRF) vulnerability present in all versions up to and including 1.3.2, caused by missing or incorrect nonce validation on the appsero_helper page. This lets unauthenticated a...