CVE-2024-12466

The Proofreading plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nonce' parameter in all versions up to, and including, 1.2.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2024-12466 Proofreading <= 1.2.1.1 - Reflected Cross-Site Scripting

The Proofreading plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nonce' parameter in all versions up to, and including, 1.2.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2024-12466

CVE-2024-12466 – WordPress Proofreading plugin : Reflected XSS via the nonce parameter in all versions up to 1.2.1.1 due to insufficient input sanitization and output escaping. Impact: unauthenticated attacker can inject scripts on pages that run when a user is tricked into an action (e.g., click...

CVE-2024-12466: Improper Neutralization of Input During Web Page Generation

The Proofreading plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nonce' parameter in all versions up to, and including, 1.2.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

PT-2025-1858 · WordPress · Proofreading Plugin

Name of the Vulnerable Software and Affected Versions: Proofreading plugin for WordPress versions up to, and including, 1.2.1.1 Description: The issue is related to Reflected Cross-Site Scripting via the nonce parameter due to insufficient input sanitization and output escaping. This allows...

CVE-2024-10789

The WP User Profile Avatar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.5. This is due to missing or incorrect nonce validation on the wpupauseradmin function. This makes it possible for unauthenticated attackers to update the plugins...

CVE-2024-10789

CVE-2024-10789 concerns the WP User Profile Avatar plugin for WordPress. The description reports a CSRF vulnerability in all versions up to 1.0.5 caused by missing or incorrect nonce validation in wpupa_user_admin(), enabling unauthenticated attackers to update plugin settings by luring an admini...

CVE-2024-10789 WP User Profile Avatar <= 1.0.5 - Cross-Site Request Forgery to Settings Update

The WP User Profile Avatar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.5. This is due to missing or incorrect nonce validation on the wpupauseradmin function. This makes it possible for unauthenticated attackers to update the plugins...

CVE-2024-10789: Cross-Site Request Forgery (CSRF)

The WP User Profile Avatar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.5. This is due to missing or incorrect nonce validation on the wpupauseradmin function. This makes it possible for unauthenticated attackers to update the plugins...

PT-2025-1606 · WordPress · Wp User Profile Avatar

Name of the Vulnerable Software and Affected Versions: WP User Profile Avatar plugin for WordPress versions up to, and including, 1.0.5 Description: The issue is due to missing or incorrect nonce validation on the wpupa user admin function, making it possible for unauthenticated attackers to upda...

BIT-PHP-MIN-2023-3247 Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP

In PHP versions 8.0. before 8.0.29, 8.1. before 8.1.20, 8.2. before 8.2.7 when using SOAP HTTP Digest Authentication, random value generator was not checked for failure, and was using narrower range of values than it should have. In case of random generator failure, it could lead to a disclosure ...

CVE-2025-0393

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.1006. This is due to missing or incorrect nonce validation on the wprfiltergridposts function. This makes it possible for unauthenticated attackers t...

CVE-2025-0393

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.1006. This is due to missing or incorrect nonce validation on the wprfiltergridposts function. This makes it possible for unauthenticated attackers t...

CVE-2025-0393 Royal Elementor Addons and Templates <= 1.7.1006 - Cross-Site Request Forgery to Reflected Cross-Site Scripting

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.1006. This is due to missing or incorrect nonce validation on the wprfiltergridposts function. This makes it possible for unauthenticated attackers t...

CVE-2025-0393

CVE-2025-0393 — The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to 1.7.1006 due to missing or incorrect nonce validation in wpr_filter_grid_posts(). This enables unauthenticated attackers to forge requests and, if a site...

CVE-2025-0393 Royal Elementor Addons and Templates <= 1.7.1006 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.1006. This is due to missing or incorrect nonce validation on the wprfiltergridposts function. This makes it possible for unauthenticated attackers t...

CVE-2024-12365

The W3 Total Cache plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the isw3tcadminpage function in all versions up to, and including, 2.8.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain...

CVE-2024-12008

The W3 Total Cache plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.8.1 through the publicly exposed debug log file. This makes it possible for unauthenticated attackers to view potentially sensitive information in the exposed log file. For exampl...

CVE-2024-12008 W3 Total Cache <= 2.8.1 Information Exposure via Log Files

The W3 Total Cache plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.8.1 through the publicly exposed debug log file. This makes it possible for unauthenticated attackers to view potentially sensitive information in the exposed log file. For exampl...

CVE-2024-12365

CVE-2024-12365 affects the W3 Total Cache WordPress plugin (versions up to and including 2.8.1). The vulnerability arises from a missing capability check in is_w3tc_admin_page, enabling authenticated attackers with Subscriber-level access or higher to obtain the plugin nonce, perform unauthorized...