1261 matches found
Hide Admin Notices < 2.3.3 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
Sign-up Sheets < 2.2.9 - Settings Update/Reset via CSRF
Description The plugin does not have CSRF check in place when updating and reseting its settings, which could allow attackers to make a logged in admin change and reset them via a CSRF attack...
Mobile Address Bar Changer <= 3.0 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
Perelink Pro <= 2.1.4 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
Google Map Shortcode <= 3.1.2 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
Woocommerce ESTO < 2.23.2 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
Live News < 1.07 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
Realbig <= 1.0.6 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings as well as clear logs and cache, which could allow attackers to make a logged in admin change them via a CSRF attack...
Video Gallery & Management < 3.3.6 - Settings Update via CSRF
Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...
CopyRightPro <= 2.1 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
HTTP Auth < 1.0.0 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
Fraud Prevention For Woocommerce < 2.1.6 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
Responsive Gallery Grid <= 2.3.10 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
MailMunch – Grow your Email List < 3.1.3 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
wpCentral <= 1.5.7 - Settings Update via CSRF
Description The plugin does not have CSRF checks when updating allowed IP addresses and reseting connection key, which could allow attackers to make logged in admins perform such actions via CSRF attacks...
WP-dTree <= 4.4.5 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
Make Paths Relative <= 1.3.0 - Settings Update via CSRF
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
WP Discord Invite < 2.5.1 - Arbitrary Settings Update via CSRF
Description The plugin does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to perform actions on their behalf by tricking a logged in administrator to submit a crafted request. alert1;'/...
CVE-2023-3510
The FTP Access WordPress plugin through 1.0 does not have authorisation and CSRF checks when updating its settings and is missing sanitisation as well as escaping in them, allowing any authenticated users, such as subscriber to update them with XSS payloads, which will be triggered when an admin...
PT-2023-25148 · WordPress · Ftp Access
Name of the Vulnerable Software and Affected Versions: FTP Access WordPress plugin versions 1.0 and earlier Description: The issue concerns a lack of authorization and CSRF checks when updating settings in the plugin, along with missing sanitization and escaping. This allows any authenticated use...