67 matches found
Ecwid Ecommerce Shopping Cart < 6.12.5 - Arbitrary Plugin Settings Change via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. PoC http://vulnerable-site.tld/wp-admin/admin-ajax.php?action=ecwidstorefrontsetpageslug=hehehehe Besides, you can disable the...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability in HasThemes ShopLentor plugin = 2.5.1 leading to plugin settings change...
CVE-2022-46797
Cross-Site Request Forgery CSRF vulnerability in Conversios All-in-one Google Analytics, Pixels and Product Feed Manager for WooCommerce plugin = 5.2.3 leads to plugin settings change...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability in Conversios All-in-one Google Analytics, Pixels and Product Feed Manager for WooCommerce plugin = 5.2.3 leads to plugin settings change...
CVE-2022-46798 WordPress WooLentor Plugin <= 2.5.1 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in HasThemes ShopLentor plugin = 2.5.1 leading to plugin settings change...
CVE-2022-40198 WordPress TeraWallet – For WooCommerce Plugin <= 1.3.24 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in StandaloneTech TeraWallet – For WooCommerce plugin = 1.3.24 leading to plugin settings change...
CVE-2022-46798: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in HasThemes ShopLentor plugin = 2.5.1 leading to plugin settings change...
CVE-2022-46797: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in Conversios All-in-one Google Analytics, Pixels and Product Feed Manager for WooCommerce plugin = 5.2.3 leads to plugin settings change...
CVE-2022-40198: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in StandaloneTech TeraWallet – For WooCommerce plugin = 1.3.24 leading to plugin settings change...
Code injection
Unauth. Plugin Settings Change vulnerability in Modula plugin = 2.6.9 on WordPress...
CVE-2022-41135
The CVE concerns the WordPress Modula image gallery plugin. Affected versions are Modula (WordPress) up to 2.6.9 (and related entries reference 2.6.91/2.6.10 as fixed/versioning in separate sources). The vulnerability is unauthenticated (no credentials required) and allows modification of plugin ...
CVE-2022-41135: Improper Access Control
Unauth. Plugin Settings Change vulnerability in Modula plugin = 2.6.9 on WordPress...
CVE-2022-40223
Nonce token leakage and missing authorization in SearchWP premium plugin = 4.2.5 on WordPress leading to plugin settings change...
CVE-2022-32587
Cross-Site Request Forgery CSRF vulnerability in CodeAndMore WP Page Widget plugin = 3.9 on WordPress leading to plugin settings change...
CVE-2022-27855
Cross-Site Request Forgery CSRF vulnerability in Fatcat Apps Analytics Cat plugin = 1.0.9 on WordPress allows Plugin Settings Change...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability in CodeAndMore WP Page Widget plugin = 3.9 on WordPress leading to plugin settings change...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability in Fatcat Apps Analytics Cat plugin = 1.0.9 on WordPress allows Plugin Settings Change...
CVE-2022-32587 WordPress WP Page Widget plugin <= 3.9 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in CodeAndMore WP Page Widget plugin = 3.9 on WordPress leading to plugin settings change...
CVE-2022-40223 WordPress SearchWP premium plugin <= 4.2.5 - Broken Authentication vulnerability
Nonce token leakage and missing authorization in SearchWP premium plugin = 4.2.5 on WordPress leading to plugin settings change...
CVE-2022-32587: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in CodeAndMore WP Page Widget plugin = 3.9 on WordPress leading to plugin settings change...