96 matches found
CVE-2026-92432
The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL through a crafted link, which is useful for phishing...
CVE-2026-92433
The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowing attackers to make a logged-in administrator re-link the integration to an attacker-controlled account via a crafted request CSRF, taking over the site's Patreon integration...
CVE-2026-92432 Patreon WordPress < 1.10.0 - Open Redirect via 'state' Parameter
The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL through a crafted link, which is useful for phishing...
CVE-2026-92432
The Patreon WordPress plugin versions before 1.10.0 is vulnerable to an Open Redirect (CWE-601) because it fails to validate a user-supplied redirect destination. Unauthenticated attackers can use a crafted link to redirect visitors to an arbitrary external URL, which can be leveraged for phishin...
EUVD-2026-103253
The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL through a crafted link, which is useful for phishing...
WordPress Patreon WordPress plugin < 1.10.0 - Open Redirect vulnerability
Open Redirect vulnerability discovered by Mike Gozdiskowski in WordPress Plugin Patreon WordPress versions 1.10.0...
CVE-2026-92432 Patreon WordPress < 1.10.0 - Open Redirect via 'state' Parameter
The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL through a crafted link, which is useful for phishing...
CVE-2026-92433
The Patreon WordPress plugin version before 1.10.0 is vulnerable to a Cross-Site Request Forgery (CSRF) flaw because it fails to verify a nonce during the account connection process. An attacker can leverage this to trick a logged-in administrator into re-linking the site's Patreon integration to...
CVE-2026-92433 Patreon WordPress < 1.10.0 - Patreon Integration Takeover via CSRF
The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowing attackers to make a logged-in administrator re-link the integration to an attacker-controlled account via a crafted request CSRF, taking over the site's Patreon integration...
CVE-2026-92431 Patreon WordPress < 1.10.0 - Unauthenticated Taxonomy and Term Enumeration
The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowing unauthenticated users to enumerate the names of terms in any taxonomy, including non-public taxonomies that WordPress does not expose on the front end...
CVE-2026-92431
The Patreon WordPress plugin (versions prior to 1.10.0 ) is vulnerable to an authorization bypass due to a missing check on certain functionalities. This flaw allows unauthenticated users to enumerate the names of terms in any taxonomy, including non-public taxonomies that are typically hidden fr...
EUVD-2026-103252
The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowing unauthenticated users to enumerate the names of terms in any taxonomy, including non-public taxonomies that WordPress does not expose on the front end...
EUVD-2026-103251
The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowing attackers to make a logged-in administrator re-link the integration to an attacker-controlled account via a crafted request CSRF, taking over the site's Patreon integration...
CVE-2026-92433 Patreon WordPress < 1.10.0 - Patreon Integration Takeover via CSRF
The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowing attackers to make a logged-in administrator re-link the integration to an attacker-controlled account via a crafted request CSRF, taking over the site's Patreon integration...
WordPress Patreon WordPress plugin < 1.10.0 - Unauthenticated Taxonomy and Term Enumeration vulnerability
Unauthenticated Taxonomy and Term Enumeration vulnerability discovered by JunHee CHO in WordPress Plugin Patreon WordPress versions 1.10.0...
WordPress Patreon WordPress plugin < 1.10.0 - Patreon Integration Takeover vulnerability
Patreon Integration Takeover vulnerability discovered by JunHee CHO in WordPress Plugin Patreon WordPress versions 1.10.0...
CVE-2026-92431 Patreon WordPress < 1.10.0 - Unauthenticated Taxonomy and Term Enumeration
The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowing unauthenticated users to enumerate the names of terms in any taxonomy, including non-public taxonomies that WordPress does not expose on the front end...
PT-2026-116374
Name of the Vulnerable Software and Affected Versions Patreon WordPress plugin versions prior to 1.10.0 Description The plugin fails to perform authorization checks on certain functionalities. This allows unauthenticated users to enumerate the names of terms within any taxonomy, including...
PT-2026-116375
Name of the Vulnerable Software and Affected Versions Patreon WordPress versions prior to 1.10.0 Description The plugin fails to validate user-supplied redirect destinations before performing a redirection. This allows unauthenticated attackers to use a crafted link to redirect visitors to an...
CVE-2026-92432: URL Redirection to Untrusted Site
The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, allowing unauthenticated attackers to redirect visitors to an arbitrary external URL through a crafted link, which is useful for phishing...