CVE-2025-14160 Upcoming for Calendly <= 1.2.4 - Cross-Site Request Forgery to Settings Update

The Upcoming for Calendly plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.4. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to update the plugin's Calendl...

CVE-2025-14160

CVE-2025-14160 concerns the Up coming for Calendly plugin for WordPress. The Wordfence vulnerability report confirms a Cross-Site Request Forgery (CSRF) flaw caused by missing nonce validation in the plugin’s settings update path, enabling unauthenticated attackers to forge requests to modify the...

CVE-2025-14392 Simple Theme Changer <= 1.0. - Missing Authorization to Plugin Settings Update via AJAX Actions

The Simple Theme Changer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the userthemeadmin, displaymethodadmin, and setchangethemebuttonname actions actions in all versions up to, and including, 1.0. This makes it possible for...

CVE-2025-14161 Truefy Embed <= 1.1.0 - Cross-Site Request Forgery to 'truefy_embed_options_update' Settings Update

The Truefy Embed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing nonce validation on the 'truefyembedoptionsupdate' settings update action. This makes it possible for unauthenticated attackers to update the...

CVE-2025-14161 Truefy Embed <= 1.1.0 - Cross-Site Request Forgery to 'truefy_embed_options_update' Settings Update

The Truefy Embed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing nonce validation on the 'truefyembedoptionsupdate' settings update action. This makes it possible for unauthenticated attackers to update the...

CVE-2025-14161

CVE-2025-14161 affects the Truefy Embed WordPress plugin (pre-1.1.0). Root cause: missing nonce validation on the truefy_embed_options_update action, enabling CSRF by unauthenticated attackers to update plugin settings (including the API key) via forged requests that trick an admin. Impact per so...

CVE-2025-14165 Kirim.Email WooCommerce Integration <= 1.2.9 - Cross-Site Request Forgery to Settings Update

The Kirim.Email WooCommerce Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.9. This is due to missing nonce validation on the plugin's settings page. This makes it possible for unauthenticated attackers to modify the plugin's...

CVE-2025-14158

CVE-2025-14158 – Coding Blocks (WordPress plugin) is a CSRF vulnerability affecting all versions up to 1.1.0. The issue arises from missing nonce validation on the settings update functionality, enabling unauthenticated attackers to forge requests that update plugin settings, including theme conf...

PT-2025-50859

The Upcoming for Calendly plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.4. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to update the plugin's Calendl...

PT-2025-50860

The Truefy Embed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing nonce validation on the 'truefy embed options update' settings update action. This makes it possible for unauthenticated attackers to update the...

PT-2025-50867

The Simple Theme Changer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted...

WordPress Truefy Embed plugin <= 1.1.0 - Cross-Site Request Forgery to 'truefy_embed_options_update' Settings Update vulnerability

Cross-Site Request Forgery to 'truefyembedoptionsupdate' Settings Update vulnerability discovered by dayea song - Ahnlab in WordPress Plugin Truefy Embed versions = 1.1.0...

WordPress Kirim.Email WooCommerce Integration plugin <= 1.2.9 - Cross-Site Request Forgery to Settings Update vulnerability

Cross-Site Request Forgery to Settings Update vulnerability discovered by Muhammad Nur Ibnu Hubab Ibnu - Pondok Teknologi in WordPress Plugin Kirim.Email WooCommerce Integration versions = 1.2.9...

WordPress Upcoming for Calendly plugin <= 1.2.4 - Cross-Site Request Forgery to Settings Update vulnerability

Cross-Site Request Forgery to Settings Update vulnerability discovered by Muhammad Nur Ibnu Hubab Ibnu - Pondok Teknologi in WordPress Plugin Upcoming for Calendly versions = 1.2.4...

WordPress Coding Blocks plugin <= 1.1.0 - Cross-Site Request Forgery to Settings Update vulnerability

Cross-Site Request Forgery to Settings Update vulnerability discovered by Muhammad Nur Ibnu Hubab Ibnu - Pondok Teknologi in WordPress Plugin Coding Blocks versions = 1.1.0...

CVE-2025-13360

The Quantic Social Image Hover plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.8. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to update the plugin's...

CVE-2025-13362

The Norby AI plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to update the plugin's settings and inject...

CVE-2025-12505 weDocs <= 2.1.14 - Missing Authorization to Settings Update

The weDocs plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.1.14. This is due to the plugin not properly verifying that a user is authorized to perform an action in the createitempermissionscheck function. This makes it possible for authenticated...

CVE-2025-12505 weDocs <= 2.1.14 - Missing Authorization to Settings Update

The weDocs plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.1.14. This is due to the plugin not properly verifying that a user is authorized to perform an action in the createitempermissionscheck function. This makes it possible for authenticated...

WordPress weDocs plugin <= 2.1.14 - Missing Authorization to Settings Update vulnerability

Missing Authorization to Settings Update vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan - Knight Squad in WordPress Plugin weDocs versions = 2.1.14...