CVE-2024-7422 Theme My Login <= 7.1.7 - Cross-Site Request Forgery to Settings Update

The Theme My Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.1.7. This is due to missing or incorrect nonce validation on the tmladminsavemssettings function. This makes it possible for unauthenticated attackers to update the theme's...

CVE-2024-7422 Theme My Login <= 7.1.7 - Cross-Site Request Forgery to Settings Update

The Theme My Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.1.7. This is due to missing or incorrect nonce validation on the tmladminsavemssettings function. This makes it possible for unauthenticated attackers to update the theme's...

WordPress Theme My Login plugin <= 7.1.7 - Cross-Site Request Forgery to Settings Update vulnerability

Cross-Site Request Forgery to Settings Update vulnerability discovered by vgo0 in WordPress Plugin Theme My Login versions = 7.1.7...

WordPress Atarim plugin <= 4.0.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update vulnerability

Missing Authorization to Authenticated Subscriber+ Settings Update vulnerability discovered by Lucio Sá in WordPress Plugin Atarim versions = 4.0.2...

CVE-2024-7621 Visual Website Collaboration, Feedback & Project Management – Atarim <= 4.0.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update

The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the processwpfeedbackmiscoptions function in all versions up to, and including, 4.0.2. This makes it possible for...

CVE-2024-7621

The CVE-2024-7621 entry concerns the Visual Website Collaboration, Feedback & Project Management – Atarim WordPress plugin. Root cause: missing capability check in process_wpfeedback_misc_options() allowed authenticated users with Subscriber level or higher to modify plugin settings and, by exten...

CVE-2024-7031 File Manager Pro – Filester <= 1.8.2 - Authenticated Plugin Settings Update

The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'njtfssaveSettingRestrictions' function in all versions up to, and including, 1.8.2. This makes it possible for authenticated attackers, with a role tha...

WordPress Funnel Builder for WordPress by FunnelKit plugin <= 3.4.6 - Missing Authorization to Authenticated (Contributor+) Settings Update vulnerability

Missing Authorization to Authenticated Contributor+ Settings Update vulnerability discovered by Lucio Sá in WordPress Plugin Funnel Builder by FunnelKit versions = 3.4.6...

WordPress Booking Ultra Pro plugin <= 1.1.13 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Updates vulnerability

Missing Authorization to Authenticated Subscriber+ Plugin Settings Updates vulnerability discovered by Lucio Sá in WordPress Plugin Booking Ultra Pro versions = 1.1.13...

WordPress LearnDash LMS - Reports Free plugin <= 1.8.2 - Missing Authorization to Plugin Settings Update vulnerability

WordPress LearnDash LMS - Reports Free plugin = 1.8.2 - Missing Authorization to Plugin Settings Update vulnerability discovered by Lucio Sá in WordPress Plugin LearnDash LMS – Reports versions = 1.8.2...

WordPress Simple Photoswipe plugin <= 0.1 - Subscriber+ Arbitrary Settings Update vulnerability

Subscriber+ Arbitrary Settings Update vulnerability discovered by Felipe Caon in WordPress Plugin Simple Photoswipe versions = 0.1...

PT-2024-37599 · WordPress · Floating Social Buttons

Name of the Vulnerable Software and Affected Versions: Floating Social Buttons plugin for WordPress versions up to, and including, 1.5 Description: The issue is due to missing or incorrect nonce validation on the floating social buttons option function, making it possible for unauthenticated...

CVE-2024-5570

The Simple Photoswipe WordPress plugin through 0.1 does not have authorisation check when updating its settings, which could allow any authenticated users, such as subscriber to update them...

CVE-2024-5570 Simple Photoswipe <= 0.1 - Subscriber+ Arbitrary Settings Update

The Simple Photoswipe WordPress plugin through 0.1 does not have authorisation check when updating its settings, which could allow any authenticated users, such as subscriber to update them...

PT-2024-36578 · WordPress · Simple Photoswipe

Name of the Vulnerable Software and Affected Versions: Simple Photoswipe WordPress plugin version 0.1 Description: The issue concerns a lack of authorization checks when updating settings, potentially allowing any authenticated user to modify them. Recommendations: For Simple Photoswipe WordPress...

WordPress ContentLock plugin <= 1.0.3 - Settings Update via CSRF vulnerability

Settings Update via CSRF vulnerability discovered by Norbert Hofmann in WordPress Plugin ContentLock versions = 1.0.3...

CVE-2024-4474

The WP Logs Book WordPress plugin through 1.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

WordPress plugin WP Logs Book security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2024-3602

The Pop ups, Exit intent popups, email popups, banners, bars, countdowns and cart savers – Promolayer plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the disconnectpromolayer function in all versions up to, and including, 1.1.0. This...

CVE-2024-3602

CVE-2024-3602 – Promolayer popup builder for WordPress is vulnerable to an unauthorized plugin settings update due to a missing capability check in the disconnect_promolayer function in versions up to 1.1.0. This allows authenticated attackers with subscriber access or higher to remove the Promol...