CVE-2021-4411 WP EasyPay – Square for WordPress <= 3.2.0 - Cross-Site Request Forgery Bypass

The WP EasyPay – Square for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.0. This is due to missing or incorrect nonce validation on the wpepdownloadtransactioninexcel function. This makes it possible for unauthenticated attackers...

CVE-2021-4410

CVE-2021-4410 — Qtranslate Slug (WordPress) CSRF : The Qtranslate Slug plugin is vulnerable through version 1.1.18 due to missing/incorrect nonce validation in the save_postdata() function, enabling unauthenticated attackers to save post data via forged requests if a site admin visits a malicious...

CVE-2021-4409 WooCommerce Etsy Integration <= 3.3.1 - Cross-Site Request Forgery Bypass

The WooCommerce Etsy Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3.1. This is due to missing or incorrect nonce validation on the etcpfdeletefeed function. This makes it possible for unauthenticated attackers to delete an export...

CVE-2021-4409 WooCommerce Etsy Integration <= 3.3.1 - Cross-Site Request Forgery Bypass

The WooCommerce Etsy Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3.1. This is due to missing or incorrect nonce validation on the etcpfdeletefeed function. This makes it possible for unauthenticated attackers to delete an export...

CVE-2021-4408 DW Question & Answer <= 1.5.8 - Cross-Site Request Forgery Bypass

The DW Question & Answer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.8. This is due to missing or incorrect nonce validation on the updateanswer function. This makes it possible for unauthenticated attackers to update answers to questions...

CVE-2020-36750 EWWW Image Optimizer <= 5.8.1 - Cross-Site Request Forgery Bypass

The EWWW Image Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.8.1. This is due to missing or incorrect nonce validation on the ewwwnggbulkinit function. This makes it possible for unauthenticated attackers to perform bulk image...

CVE-2021-4407

The Custom Banners plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.2 This is due to missing or incorrect nonce validation on the saveCustomFields function. This makes it possible for unauthenticated attackers to save custom fields via a forge...

CVE-2020-36750

The CVE-2020-36750 entry concerns the WordPress EWWW Image Optimizer plugin. Affected component: ewww_ngg_bulk_init() function in versions up to and including 5.8.1. Root cause: insufficient nonce validation leads to a Cross-Site Request Forgery (CSRF). Impact: unauthenticated attackers could tri...

PT-2023-12520 · WordPress · Dw Question & Answer Pro

Name of the Vulnerable Software and Affected Versions: DW Question & Answer plugin for WordPress versions up to, and including, 1.5.8 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the update answer function. This allows...

PT-2023-12539 · WordPress · Absolute Reviews

Name of the Vulnerable Software and Affected Versions: Absolute Reviews plugin for WordPress versions up to, and including, 1.0.8 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the metabox review save function. This allows...

PT-2023-12529 · WordPress · The Forminator Forms

Name of the Vulnerable Software and Affected Versions: The Forminator – Contact Form, Payment Form & Custom Form Builder plugin for WordPress versions up to, and including, 1.13.4 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the...

PT-2023-12527 · WordPress · Sunshine Photo Cart

Name of the Vulnerable Software and Affected Versions: Sunshine Photo Cart plugin for WordPress versions up to, and including, 2.8.28 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the sunshine products quicksave post function. This...

PT-2023-23558 · WordPress · Mstore Api

Name of the Vulnerable Software and Affected Versions: MStore API plugin for WordPress affected versions not specified Description: The issue is related to Cross-Site Request Forgery due to missing nonce validation on the mstore update status order title function. This allows unauthenticated...

PT-2023-12528 · WordPress · Wp-Mpdf

Name of the Vulnerable Software and Affected Versions: wp-mpdf plugin for WordPress versions up to, and including, 3.5.1 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the mpdf admin savepost function. This allows unauthenticated...

PT-2023-12526 · WordPress · Abandoned Cart Lite For Woocommerce

Name of the Vulnerable Software and Affected Versions: Abandoned Cart Lite for WooCommerce plugin for WordPress versions up to and including 5.8.5 Description: The issue arises from missing or incorrect nonce validation on the wcal preview emails function, allowing unauthenticated attackers to...

PT-2023-12524 · WordPress · Wp Prayer

Name of the Vulnerable Software and Affected Versions: WP Prayer plugin for WordPress versions up to, and including, 1.6.5 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the save and export functions. This allows unauthenticated...

PT-2023-12522 · WordPress · Qtranslate Slug

Name of the Vulnerable Software and Affected Versions: Qtranslate Slug plugin for WordPress versions up to and including 1.1.18 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the save postdata function. This allows unauthenticated...

PT-2023-12537 · WordPress · Slider Hero

Name of the Vulnerable Software and Affected Versions: Slider Hero plugin for WordPress versions up to and including 8.2.0 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the qc slider hero duplicate function. This allows...

PT-2023-12535 · WordPress · Advanced Popups

Name of the Vulnerable Software and Affected Versions: Advanced Popups plugin for WordPress versions up to, and including, 1.1.1 Description: The issue is due to missing or incorrect nonce validation on the metabox popup save function, making it possible for unauthenticated attackers to save meta...

WordPress Plugin Sell Media 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...