6 matches found
CVE-2026-7444: Cross-Site Request Forgery (CSRF)
The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.16. This is due to missing or incorrect nonce validation on the processbulkaction function of MWTSAStatsTable. This makes it possible for unauthenticated attacker...
CVE-2026-15136: Cross-Site Request Forgery (CSRF)
The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.3.7. This is due to missing or incorrect nonce validation on the processbulkaction function. This makes it possible for unauthenticated...
CVE-2026-6455: Cross-Site Request Forgery (CSRF)
The WP Contact Form 7 DB Handler plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Arbitrary File Deletion via SQL Injection and PHP Object Injection in versions up to and including 3.0. This is due to a missing nonce verification in the processbulkaction function, the...
CVE-2025-13685: Cross-Site Request Forgery (CSRF)
The Photo Gallery by Ays plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.4.8. This is due to missing nonce verification on the bulk action functionality in the 'processbulkaction' function. This makes it possible for unauthenticated attacke...
CVE-2025-9949: Cross-Site Request Forgery (CSRF)
The Internal Links Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on the link deletion functionality in the processbulkaction function. This makes it possible for...
Floating Button < 6.0.1 - Cross-Site Request Forgery via process_bulk_action
Description The Floating Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.0. This is due to missing or incorrect nonce validation on the processbulkaction function. This makes it possible for unauthenticated attackers to process bulk...