CVE-2024-7984

The CVE concerns the WordPress plugin Joy Of Text Lite (SMS messaging for WordPress) versions 2.3.1 and earlier. The vulnerability arises from a missing CSRF check when updating plugin settings, which could allow an attacker to cause a logged-in admin to change settings via CSRF. Exploitation det...

CVE-2024-6719

The CVE-2024-6719 entry concerns the WordPress plugin “Offload Videos” (bunny.net/AWS S3 integration) prior to version 1.0.1. According to the documentation, the vulnerability arises from a missing CSRF check when updating plugin settings, which could allow low-privilege users to alter settings v...

CVE-2024-12750 Competition Form <= 2.0 - Competition Deletion via CSRF

The Competition Form WordPress plugin through 2.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-12750

CVE-2024-12750 concerns the WordPress plugin Competition Form (versions

CVE-2024-11373 Connexion Logs <= 3.0.2 - Log Deletion via CSRF

The Connexion Logs WordPress plugin through 3.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-10677 BTEV <= 2.0.2 - Settings Update via CSRF

The BTEV WordPress plugin through 2.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-10677

CVE-2024-10677 affects the BTEV WordPress plugin up to version 2.0.2. The vulnerability is a lack of CSRF protection when updating plugin settings, which could let an attacker, in a CSRF context, cause a logged-in administrator to change settings. The CVE description and entries from NVD/Red Hat ...

CVE-2024-10677 BTEV <= 2.0.2 - Settings Update via CSRF

The BTEV WordPress plugin through 2.0.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-46506

NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because function=savesettings lacks an authentication requirement, as exploited in the wild in May 2025. This is related to settings.php and util.php...

PT-2025-21516 · WordPress · Gamipress

Name of the Vulnerable Software and Affected Versions: GamiPress versions prior to 1.0.1 Description: The issue concerns the lack of CSRF check when updating settings, which could allow attackers to make a logged-in administrator change them via a CSRF attack. This could potentially permit...

WordPress plugin Simple Nav Archives 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security...

PT-2025-21388

Name of the Vulnerable Software and Affected Versions: TwitterPosts WordPress plugin versions 1.0.0 through 1.0.2 Description: The issue is related to the lack of a CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack...

PT-2025-21381 · WordPress · The Ultimate Noindex Nofollow Tool

Name of the Vulnerable Software and Affected Versions: The Ultimate Noindex Nofollow Tool WordPress plugin versions 1.1.2 and earlier Description: The issue concerns a lack of CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack...

PT-2025-21384 · WordPress · Illi Link Party!

Name of the Vulnerable Software and Affected Versions: The illi Link Party! WordPress plugin version 1.0 Description: The issue is related to the lack of a CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. Recommendations: For...

PT-2025-21566 · WordPress · Wp-Pmanager

Name of the Vulnerable Software and Affected Versions: WP-PManager plugin versions 1.2 and earlier Description: The issue concerns the lack of a CSRF check when updating settings in the WP-PManager plugin. This could allow attackers to make a logged-in administrator change settings via a CSRF...

PT-2025-21409 · WordPress · Btev Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: BTEV WordPress plugin versions 2.0.2 and earlier Description: The issue concerns the lack of a CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. This could potentially enab...

WordPress plugin Ntz Antispam 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin Connexion Logs 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability...

WordPress plugin TwitterPosts 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2025-21513 · WordPress · Ntz Antispam

Name of the Vulnerable Software and Affected Versions: Ntz Antispam WordPress plugin versions 2.0e and earlier Description: The issue concerns the lack of a CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. Recommendations: For...