CVE-2024-13356

The CVE CVE-2024-13356 affects DSGVO All in one for WP (WordPress) plugins up to version 4.6. The root cause is missing/invalid nonce validation in user_remove_form.php, enabling Cross-Site Request Forgery that can allow unauthenticated attackers to delete admin accounts if a site admin is tricke...

CVE-2024-13356 DSGVO All in one for WP <= 4.6 - Cross-Site Request Forgery to Account Deletion

The DSGVO All in one for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.6. This is due to missing or incorrect nonce validation in the userremoveform.php file. This makes it possible for unauthenticated attackers to delete admin user...

CVE-2024-13510: Cross-Site Request Forgery (CSRF)

The ShopSite plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.10. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts...

PT-2025-2197

Name of the Vulnerable Software and Affected Versions ShopSite plugin for WordPress versions up to, and including, 1.5.10 Description The issue is due to missing or incorrect nonce validation on a function, making it possible for unauthenticated attackers to update settings and inject malicious w...

PT-2025-2131 · WordPress · Dsgvo All In One For Wp

Name of the Vulnerable Software and Affected Versions: DSGVO All in one for WP plugin for WordPress versions up to, and including, 4.6 Description: The issue is due to missing or incorrect nonce validation in the user remove form.php file, making it possible for unauthenticated attackers to delet...

PT-2025-9452

Name of the Vulnerable Software and Affected Versions Social Links versions prior to 1.0.12 Description The Social Links plugin for WordPress contains a Cross-Site Request Forgery CSRF and Stored Cross-Site Scripting XSS issue. The flaw stems from missing or incorrect nonce validation—a security...

Bot Protection Bypass

Anubis is vulnerable to Bot Protection Bypass. The vulnerability is due to insufficient validation due to allowing attackers to specify a nonce and set the challenge difficulty to zero, effectively bypassing the bot protection mechanism...

CVE-2024-13707

The WP Image Uploader plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the gkyimageuploadermainfunction function. This makes it possible for unauthenticated attackers to delete...

CVE-2024-13512

The Wonder FontAwesome plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.8. This is due to missing or incorrect nonce validation on one of its functions. This makes it possible for unauthenticated attackers to update settings and inject...

CVE-2024-13512

The Wonder FontAwesome plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.8. This is due to missing or incorrect nonce validation on one of its functions. This makes it possible for unauthenticated attackers to update settings and inject...

CVE-2024-13707 WP Image Uploader <= 1.0.1 - Cross-Site Request Forgery to Arbitrary File Deletion

The WP Image Uploader plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the gkyimageuploadermainfunction function. This makes it possible for unauthenticated attackers to delete...

CVE-2024-13707

CVE-2024-13707 affects the WordPress plugin WP Image Uploader (versions up to 1.0.1). The vulnerability is a Cross-Site Forgery vulnerability caused by missing/incorrect nonce validation in gky_image_uploader_main_function(), enabling unauthenticated attackers to delete arbitrary files via a forg...

CVE-2024-13707 WP Image Uploader <= 1.0.1 - Cross-Site Request Forgery to Arbitrary File Deletion

The WP Image Uploader plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the gkyimageuploadermainfunction function. This makes it possible for unauthenticated attackers to delete...

CVE-2024-13512

CVE-2024-13512 affects the WordPress plugin Wonder FontAwesome (versions ≤ 0.8). The vulnerability is a Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on a function, enabling unauthenticated attackers to update settings and inject malicious scripts via forged reque...

CVE-2024-13512 Wonder FontAwesome <= 0.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Wonder FontAwesome plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.8. This is due to missing or incorrect nonce validation on one of its functions. This makes it possible for unauthenticated attackers to update settings and inject...

CVE-2024-13758 CP Contact Form with PayPal <= 1.3.52 - Cross-Site Request Forgery

The CP Contact Form with PayPal plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.52. This is due to missing or incorrect nonce validation on the cpcontactformpaypalcheckinitactions function. This makes it possible for unauthenticated...

CVE-2024-13758

CVE-2024-13758 involves the CP Contact Form with PayPal plugin for WordPress. The vulnerability is a Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation in cp_contact_form_paypal_check_init_actions(), affecting all versions up to and including 1.3.52. This allows unauth...

CVE-2024-13758 CP Contact Form with PayPal <= 1.3.52 - Cross-Site Request Forgery

The CP Contact Form with PayPal plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.52. This is due to missing or incorrect nonce validation on the cpcontactformpaypalcheckinitactions function. This makes it possible for unauthenticated...

PT-2025-2199 · WordPress · Wonder Fontawesome

Name of the Vulnerable Software and Affected Versions: Wonder FontAwesome plugin for WordPress versions up to, and including, 0.8 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation in one of the plugin's functions. This allows...

PT-2025-2263 · WordPress · Cp Contact Form With Paypal

Name of the Vulnerable Software and Affected Versions: CP Contact Form with PayPal plugin for WordPress versions up to, and including, 1.3.52 Description: The issue is due to missing or incorrect nonce validation on the cp contact form paypal check init actions function. This allows unauthenticat...