CVE-2022-3879

The Car Dealer Dealership and Vehicle sales WordPress Plugin WordPress plugin before 3.05 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugins from wordpress.org...

PT-2022-24582 · WordPress · Memory Usage

Name of the Vulnerable Software and Affected Versions: Memory Usage, Memory Limit, PHP and Server Memory Health Check and Fix Plugin WordPress plugin versions prior to 2.46 Description: The issue concerns a lack of proper authorization and CSRF protection in an AJAX action. This allows any...

PT-2022-23613 · WordPress · Advanced Import

Name of the Vulnerable Software and Affected Versions: Advanced Import WordPress plugin versions prior to 1.3.8 Description: The issue concerns a lack of CSRF check in the Advanced Import WordPress plugin, allowing attackers to make a logged-in admin install arbitrary plugins from WordPress.org a...

CVE-2022-1656

Vulnerable versions of the JupiterX Theme =2.0.6 allow any logged-in user, including subscriber-level users, to access any of the functions registered in lib/api/api/ajax.php, which also grant access to the jupiterxapiajax actions registered by the JupiterX Core Plugin =2.0.6. This includes the...

Subrion CMS CSRF Vulnerability

Subrion CMS 4.2.1 has CSRF in panel/modules/plugins/. The attacker can remotely activate/deactivate the plugins...

WordPress plugin Access Demo Importer cross-site request forgery vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress plugin Access Demo Importer 1.0.7 and earlier versions are vulnerable to cross-site request...

CVE-2022-23975

Cross-Site Request Forgery CSRF in Access Demo Importer = 1.0.7 on WordPress allows an attacker to activate any installed plugin...

CVE-2022-23975

Cross-Site Request Forgery CSRF in Access Demo Importer = 1.0.7 on WordPress allows an attacker to activate any installed plugin...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF in Access Demo Importer = 1.0.7 on WordPress allows an attacker to activate any installed plugin...

CVE-2022-23975 WordPress Access Demo Importer plugin <= 1.0.7 - Cross-Site Request Forgery (CSRF) vulnerability leading to Arbitrary Plugin Activation

Cross-Site Request Forgery CSRF in Access Demo Importer = 1.0.7 on WordPress allows an attacker to activate any installed plugin...

WordPress Event Single Page Templates Addon For The Events Calendar plugin <= 1.5 - Arbitrary Plugin Activation vulnerability

Arbitrary Plugin Activation vulnerability discovered by Jerome Bruandet NinTechNet in WordPress Event Single Page Templates Addon For The Events Calendar plugin versions = 1.5. Solution Update the WordPress Event Single Page Templates Addon For The Events Calendar plugin to the latest available...

WordPress The Events Calendar Search Addon plugin <= 1.1.3 - Arbitrary Plugin Activation vulnerability

Arbitrary Plugin Activation vulnerability discovered by Jerome Bruandet NinTechNet in WordPress The Events Calendar Search Addon plugin versions = 1.1.3. Solution Update the WordPress The Events Calendar Search Addon plugin to the latest available version at least 1.2.1...

WordPress The Events Calendar Countdown Addon plugin <= 1.3.1 - Arbitrary Plugin Activation vulnerability

Arbitrary Plugin Activation vulnerability discovered by Jerome Bruandet NinTechNet in WordPress The Events Calendar Countdown Addon plugin versions = 1.3.1. Solution Update the WordPress The Events Calendar Countdown Addon plugin to the latest available version at least 1.4...

WordPress Events Shortcodes For The Events Calendar plugin <= 1.9 - Arbitrary Plugin Activation vulnerability

Arbitrary Plugin Activation vulnerability discovered by Jerome Bruandet NinTechNet in WordPress Events Shortcodes For The Events Calendar plugin versions = 1.9. Solution Update the WordPress Events Shortcodes For The Events Calendar plugin to the latest available version at least 2.0...

WordPress Cryptocurrency Widgets – Price Ticker & Coins List plugin <= 2.4 - Arbitrary Plugin Activation vulnerability

Arbitrary Plugin Activation vulnerability discovered by Jerome Bruandet NinTechNet in WordPress Cryptocurrency Widgets – Price Ticker & Coins List plugin versions = 2.4. Solution Update the WordPress Cryptocurrency Widgets – Price Ticker & Coins List plugin to the latest available version at leas...

WordPress Cool Timeline plugin <= 2.3.3 - Arbitrary Plugin Activation vulnerability

Arbitrary Plugin Activation vulnerability discovered by Jerome Bruandet NinTechNet in WordPress Cool Timeline plugin versions = 2.3.3. Solution Update the WordPress Cool Timeline plugin to the latest available version at least 2.4...

WordPress Opstore theme <= 1.4.3 - Authenticated Arbitrary Plugin Activation/Deactivation vulnerability

Authenticated Arbitrary Plugin Activation/Deactivation vulnerability discovered by Ex.Mi Patchstack in WordPress Opstore theme versions = 1.4.3. Solution Deactivate and delete. The vendor ignores the vulnerability reports, avoids any conversation...

WordPress Ultra Seven theme <= 1.2.8 - Authenticated Arbitrary Plugin Activation/Deactivation vulnerability

Authenticated Arbitrary Plugin Activation/Deactivation vulnerability discovered by Ex.Mi Patchstack in WordPress Ultra Seven theme versions = 1.2.8. Solution Deactivate and delete. The vendor ignores the vulnerability reports, avoids any conversation...

WordPress Punte theme <= 1.1.2 - Authenticated Arbitrary Plugin Activation/Deactivation vulnerability

Authenticated Arbitrary Plugin Activation/Deactivation vulnerability discovered by Ex.Mi Patchstack in WordPress Punte theme versions = 1.1.2. Solution Deactivate and delete. The vendor ignores the vulnerability reports, avoids any conversation...

WordPress The Launcher theme <= 1.3.2 - Authenticated Arbitrary Plugin Activation/Deactivation vulnerability

Authenticated Arbitrary Plugin Activation/Deactivation vulnerability discovered by Ex.Mi Patchstack in WordPress The Launcher theme versions = 1.3.2. Solution Deactivate and delete. The vendor ignores the vulnerability reports, avoids any conversation...