Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in ARI Soft Contact Form 7 Connector.This issue affects Contact Form 7 Connector: from n/a through 1.2.2...

CVE-2024-24875

CVE-2024-24875 is a CSRF vulnerability in the WordPress Link Library plugin by Yannick Lefebvre, affecting Link Library versions through 7.5.13. The issue allows an attacker to perform unintended actions on behalf of an authenticated user (CSRF). The available connected documents indicate a fix i...

CVE-2024-24884

Summary: CVE-2024-24884 is a CSRF vulnerability in the ARI Soft Contact Form 7 Connector plugin for WordPress. The issue affects versions up to and including 1.2.2 and can be triggered without authentication, enabling an attacker to induce state-changing actions in a user’s session. The patchstac...

CVE-2024-24887

CVE-2024-24887 is a CSRF vulnerability in the WordPress plugin Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting (Contest Gallery). Affected versions are up to 21.2.8.4; patch 21.2.9 fixes the issue. Patchstack and CVE records confirm low-severity risk with una...

CVE-2024-24929

CVE-2024-24929 is a CSRF vulnerability affecting the WordPress WP Contact Form plugin (versions

CVE-2024-24935

CVE-2024-24935 is a CSRF vulnerability in the WordPress plugin WpSimpleTools Basic Log Viewer (Basic Log Viewer). Affected version range is up to and including 1.0.4 . The CVE entry notes a CSRF risk that could enable unauthorized actions, but the provided connected documents indicate the vulnera...

CVE-2023-46615

CVE-2023-46615 affects the WordPress KD Coming Soon plugin. Multiple sources confirm a PHP Object Injection (deserialization of untrusted data) vulnerability in KD Coming Soon <= 1.7, with unauthenticated access. One document notes a potential code execution path if a POP chain exists with oth...

CVE-2024-23512

CVE-2024-23512: WordPress ProductX – WooCommerce Builder & Gutenberg WooCommerce Blocks is affected by a PHP Object Injection via deserialization of untrusted data in versions ≤ 3.1.4. Patch 3.1.5 resolves the issue. No exploitation details are provided in the supplied documents. Remediation: upg...

CVE-2023-41708

Summary of CVE-2023-41708 details : The issue affects the Open-Xchange App Suite, specifically theapp loader functionality. The vulnerability arises from how app references can redirect to unexpected locations, enabling attackers to forge app references and bypass safeguards to inject malicious s...

CVE-2023-41704

CVE-2023-41704 affects the Open-Xchange App Suite (email client) where processing of CID references in email messages can be abused to inject malicious script that bypasses the sanitization engine. This could enable script execution in a user’s session when interacting with emails. The advisory r...

Deserialization of untrusted data

Deserialization of Untrusted Data vulnerability in G5Theme ERE Recently Viewed – Essential Real Estate Add-On.This issue affects ERE Recently Viewed – Essential Real Estate Add-On: from n/a through 1.3...

Deserialization of untrusted data

Deserialization of Untrusted Data vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently – WordPress Plugin.This issue affects Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently – WordPress Plugin: from n/a through 4.1.1...

Deserialization of untrusted data

Deserialization of Untrusted Data vulnerability in PropertyHive.This issue affects PropertyHive: from n/a through 2.0.5...

Deserialization of untrusted data

Deserialization of Untrusted Data vulnerability in UnitedThemes Brooklyn | Creative Multi-Purpose Responsive WordPress Theme.This issue affects Brooklyn | Creative Multi-Purpose Responsive WordPress Theme: from n/a through 4.9.7.6...

CVE-2024-23513

CVE-2024-23513 is a PHP Object Injection/deserialization vulnerability in WordPress PropertyHive

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NinjaTeam WP Chat App allows Stored XSS.This issue affects WP Chat App: from n/a through 3.4.4...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Geek Code Lab All 404 Pages Redirect to Homepage allows Stored XSS.This issue affects All 404 Pages Redirect to Homepage: from n/a through 1.9...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Chart Builder Team Chartify – WordPress Chart Plugin allows Stored XSS.This issue affects Chartify – WordPress Chart Plugin: from n/a through 2.0.6...

CVE-2024-25100

CVE-2024-25100 is a Deserialization of Untrusted Data vulnerability in the WordPress Coupon Referral Program plugin (coupon-referral-program) affecting versions up to 1.7.2 (n/a before 1.8.4 per sources). The issue is an unauthenticated PHP object injection vulnerability in WP Swings Coupon Refer...

CVE-2023-51370

CVE-2023-51370 affects the WordPress WP Chat App plugin (NinjaTeam) up to version 3.4.4. The vulnerability is a Stored XSS caused by improper neutralization of user input during web page generation. PatchStack lists a fix in version 3.4.5; there are no explicit exploitation details in the provide...