Gallery for Social Photo < 1.0.0.29 - Arbitrary Post Duplication via CSRF

The plugin does not have CSRF check in place when duplicating a post or page, which could allow attackers to make a logged in a admin duplicate them via a CSRF attack PoC https://example.com/wp-admin/admin-ajax.php?action=gifeedduplicatefeed=12...

Logo Carousel < 3.4.2 - Unauthorised Private Post Access

The plugin allows users with a role as low as Contributor to duplicate and view arbitrary private posts made by other users via the Carousel Duplication feature 1 Go to Logo Carousel - Shortcode Generator. 2 If there is no carousel, create one. 3 Copy URL of the "Duplicate" link under the carouse...

WordPress Tooltipy 5.0 Cross Site Request Forgery

Details ================ Software: Tooltipy tooltips for WP Version: 5.0 Homepage: https://wordpress.org/plugins/bluet-keywords-tooltip-generator/ Advisory report: https://advisories.dxw.com/advisories/csrf-in-tooltipy/ CVE: Awaiting assignment CVSS: 4.3 Medium; AV:N/AC:M/Au:N/C:N/I:P/A:N...