PT-2023-11876 · Cartflows · Woocommerce Checkout & Funnel Builder By Cartflows

Name of the Vulnerable Software and Affected Versions: WooCommerce Checkout & Funnel Builder by CartFlows plugin for WordPress versions up to, and including, 1.5.15 Description: The issue is due to missing or incorrect nonce validation on the export json, import json, and status logs file...

PT-2023-12504 · WordPress · Ecommerce Product Catalog Plugin

Name of the Vulnerable Software and Affected Versions: eCommerce Product Catalog Plugin for WordPress versions up to, and including, 2.9.43 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the implecode save products meta function. Th...

PT-2023-12506 · WordPress · Locations

Name of the Vulnerable Software and Affected Versions: Locations plugin for WordPress versions up to, and including, 3.2.1 Description: The issue is due to missing or incorrect nonce validation on the saveCustomFields function, making it possible for unauthenticated attackers to update custom fie...

PT-2023-11889 · WordPress · Easy Testimonials

Name of the Vulnerable Software and Affected Versions: Easy Testimonials plugin for WordPress versions up to and including 3.6.1 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the saveCustomFields function. This allows unauthenticat...

PT-2023-11875 · WordPress · Wp Erp

Name of the Vulnerable Software and Affected Versions: WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress versions up to, and including, 1.6.3 Description: The issue is due to missing or incorrect nonce validation on the handle leave...

PT-2023-11882 · WordPress · Custom Field Template

Name of the Vulnerable Software and Affected Versions: Custom Field Template plugin for WordPress versions up to, and including, 2.5.1 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the edit meta value function. This allows...

Cross site request forgery (csrf)

The Subscribe2 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.40. This is due to missing or incorrect nonce validation when sending test emails. This makes it possible for unauthenticated attackers to send test emails with custom content to...

CVE-2023-3407 Subscribe2 <= 10.40 - Cross-Site Request Forgery

The Subscribe2 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.40. This is due to missing or incorrect nonce validation when sending test emails. This makes it possible for unauthenticated attackers to send test emails with custom content to...

CVE-2023-3427

The Salon Booking System plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.6. This is due to missing or incorrect nonce validation on the 'savecustomer' function. This makes it possible for unauthenticated attackers to change the admin role to...

CVE-2023-3427

The Salon Booking System plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.6. This is due to missing or incorrect nonce validation on the 'savecustomer' function. This makes it possible for unauthenticated attackers to change the admin role to...

CVE-2023-3427 Salon Booking System <= 8.4.6 - Cross-Site Request Forgery to Admin Role Change to Customer, User Meta Update via save_customer

The Salon Booking System plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.6. This is due to missing or incorrect nonce validation on the 'savecustomer' function. This makes it possible for unauthenticated attackers to change the admin role to...

CVE-2023-3427 Salon Booking System <= 8.4.6 - Cross-Site Request Forgery to Admin Role Change to Customer, User Meta Update via save_customer

The Salon Booking System plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.6. This is due to missing or incorrect nonce validation on the 'savecustomer' function. This makes it possible for unauthenticated attackers to change the admin role to...

PT-2023-24785 · WordPress · Salon Booking System

Name of the Vulnerable Software and Affected Versions: The Salon Booking System plugin for WordPress versions up to, and including, 8.4.6 Description: The issue is due to missing or incorrect nonce validation on the save customer function, making it possible for unauthenticated attackers to chang...

PT-2023-24658 · WordPress · Subscribe2

Name of the Vulnerable Software and Affected Versions: Subscribe2 plugin for WordPress versions up to, and including, 10.40 Description: The issue is due to missing or incorrect nonce validation when sending test emails, making it possible for unauthenticated attackers to send test emails with...

CVE-2023-3411

The Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.0. This is due to missing nonce validation on the ajaxstoresave function. This makes it possible for unauthenticated...

CVE-2023-3411

The Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.0. This is due to missing nonce validation on the ajaxstoresave function. This makes it possible for unauthenticated...

Cross site request forgery (csrf)

The Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.0. This is due to missing nonce validation on the ajaxstoresave function. This makes it possible for unauthenticated...

CVE-2023-3411 Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.0. This is due to missing nonce validation on the ajaxstoresave function. This makes it possible for unauthenticated...

CVE-2023-3411 Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.0. This is due to missing nonce validation on the ajaxstoresave function. This makes it possible for unauthenticated...

PT-2023-24681 · WordPress · Image Map Pro

Name of the Vulnerable Software and Affected Versions: Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite plugin for WordPress versions up to, and including, 1.0.0 Description: The issue is due to missing nonce validation on the ajax store save function, making it possible for...