CVE-2024-13522 magayo Lottery Results <= 2.0.12 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The magayo Lottery Results plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.12. This is due to missing or incorrect nonce validation on the 'magayo-lottery-results' page. This makes it possible for unauthenticated attackers to update...

what3words Address Field < 4.0.16 - Cross-Site Request Forgery to Stored Cross-Site Scripting

Description The what3words Address Field plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.15. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and...

CVE-2024-13718: Cross-Site Request Forgery (CSRF)

The Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.26. This is due to missing or incorrect nonce validation on several functions. This makes it possible for...

CVE-2024-13523: Cross-Site Request Forgery (CSRF)

The MemorialDay plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web script...

CVE-2024-13852: Cross-Site Request Forgery (CSRF)

The Option Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing nonce validation on the pluginpage function. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forged request, grant...

CVE-2024-13522: Cross-Site Request Forgery (CSRF)

The magayo Lottery Results plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.12. This is due to missing or incorrect nonce validation on the 'magayo-lottery-results' page. This makes it possible for unauthenticated attackers to update...

PT-2025-6558

Name of the Vulnerable Software and Affected Versions magayo Lottery Results plugin for WordPress versions up to, and including, 2.0.12 Description The issue is due to missing or incorrect nonce validation on the 'magayo-lottery-results' page, making it possible for unauthenticated attackers to...

PT-2025-6539

Name of the Vulnerable Software and Affected Versions Shopwarden – Automated WooCommerce monitoring & testing plugin for WordPress versions up to, and including, 1.0.11 Description The issue is due to missing or incorrect nonce validation on the save setting function. This makes it possible for...

PT-2025-6617

Name of the Vulnerable Software and Affected Versions Option Editor plugin for WordPress version 1.0 Description The issue is due to missing nonce validation on the plugin page function, making it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forge...

PT-2025-6595

Name of the Vulnerable Software and Affected Versions Reset plugin for WordPress versions up to, and including, 1.6 Description The issue is due to missing or incorrect nonce validation on the reset db page function, making it possible for unauthenticated attackers to reset several tables in the...

PT-2025-6565 · WordPress · 1 Click Wordpress Migration Plugin

Name of the Vulnerable Software and Affected Versions: 1 Click WordPress Migration Plugin – 100% FREE for a limited time versions up to 2.1 Description: The issue is related to Cross-Site Request Forgery. This is due to missing or incorrect nonce validation on the cancel actions function. This...

PT-2025-6545 · WordPress · Speedsize Image & Video Ai-Optimizer

Name of the Vulnerable Software and Affected Versions: SpeedSize Image & Video AI-Optimizer plugin for WordPress versions up to, and including, 1.5.1 Description: The issue is due to missing or incorrect nonce validation on the speedsize clear css cache action function, making it possible for...

PT-2025-6559 · WordPress · Memorialday

Name of the Vulnerable Software and Affected Versions: MemorialDay plugin for WordPress versions up to, and including, 1.0.4 Description: The issue is due to missing or incorrect nonce validation on a function, making it possible for unauthenticated attackers to update settings and inject malicio...

CVE-2024-10581

The DirectoryPress Frontend plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.9. This is due to missing or incorrect nonce validation on the dpfllistingStatusChange function. This makes it possible for unauthenticated attackers to update...

1 Click WordPress Migration Plugin – 100% FREE for a limited time <= 2.2 - Cross-Site Request Forgery to Backup Process Cancellation

Description The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or incorrect nonce validation on the cancelactions function. This makes it possible...

CVE-2024-10581

The DirectoryPress Frontend plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.9. This is due to missing or incorrect nonce validation on the dpfllistingStatusChange function. This makes it possible for unauthenticated attackers to update...

CVE-2024-10581

The DirectoryPress Frontend plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.9. This is due to missing or incorrect nonce validation on the dpfllistingStatusChange function. This makes it possible for unauthenticated attackers to update...

CVE-2024-10581

CVE-2024-10581 affects DirectoryPress Frontend for WordPress (

CVE-2024-10581 DirectoryPress Frontend <= 2.7.9 - Cross-Site Request Forgery to Listing Status Update

The DirectoryPress Frontend plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.9. This is due to missing or incorrect nonce validation on the dpfllistingStatusChange function. This makes it possible for unauthenticated attackers to update...

CVE-2024-10581 DirectoryPress Frontend <= 2.7.9 - Cross-Site Request Forgery to Listing Status Update

The DirectoryPress Frontend plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.9. This is due to missing or incorrect nonce validation on the dpfllistingStatusChange function. This makes it possible for unauthenticated attackers to update...