1253 matches found
CVE-2024-7690 DN Popup <= 1.2.2 - Settings Update via CSRF
The DN Popup WordPress plugin through 1.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
WordPress infolinks Ad Wrap plugin <= 1.0.2 - Cross-Site Request Forgery to Settings Update vulnerability
Cross-Site Request Forgery to Settings Update vulnerability discovered by Daniel Ruf in WordPress Plugin infolinks Ad Wrap versions = 1.0.2...
CVE-2024-5940 GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Missing Authorization to Unauthenticated Event Settings Update
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'handlerequest' function in all versions up to, and including, 3.13.0. This makes it possible for unauthenticated attackers to edi...
CVE-2023-4027 Radio Player <= 2.0.73 - Missing Authorization to Settings Update
The Radio Player plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the updatesettings function in versions up to, and including, 2.0.73. This makes it possible for unauthenticated attackers to update plugin settings...
CVE-2024-7422 Theme My Login <= 7.1.7 - Cross-Site Request Forgery to Settings Update
The Theme My Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.1.7. This is due to missing or incorrect nonce validation on the tmladminsavemssettings function. This makes it possible for unauthenticated attackers to update the theme's...
CVE-2024-7422 Theme My Login <= 7.1.7 - Cross-Site Request Forgery to Settings Update
The Theme My Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.1.7. This is due to missing or incorrect nonce validation on the tmladminsavemssettings function. This makes it possible for unauthenticated attackers to update the theme's...
WordPress Theme My Login plugin <= 7.1.7 - Cross-Site Request Forgery to Settings Update vulnerability
Cross-Site Request Forgery to Settings Update vulnerability discovered by vgo0 in WordPress Plugin Theme My Login versions = 7.1.7...
WordPress Atarim plugin <= 4.0.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update vulnerability
Missing Authorization to Authenticated Subscriber+ Settings Update vulnerability discovered by Lucio Sá in WordPress Plugin Atarim versions = 4.0.2...
CVE-2024-7621 Visual Website Collaboration, Feedback & Project Management – Atarim <= 4.0.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update
The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the processwpfeedbackmiscoptions function in all versions up to, and including, 4.0.2. This makes it possible for...
CVE-2024-7621
The CVE-2024-7621 entry concerns the Visual Website Collaboration, Feedback & Project Management – Atarim WordPress plugin. Root cause: missing capability check in process_wpfeedback_misc_options() allowed authenticated users with Subscriber level or higher to modify plugin settings and, by exten...
CVE-2024-7031 File Manager Pro – Filester <= 1.8.2 - Authenticated Plugin Settings Update
The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'njtfssaveSettingRestrictions' function in all versions up to, and including, 1.8.2. This makes it possible for authenticated attackers, with a role tha...
WordPress Funnel Builder for WordPress by FunnelKit plugin <= 3.4.6 - Missing Authorization to Authenticated (Contributor+) Settings Update vulnerability
Missing Authorization to Authenticated Contributor+ Settings Update vulnerability discovered by Lucio Sá in WordPress Plugin Funnel Builder by FunnelKit versions = 3.4.6...
WordPress Booking Ultra Pro plugin <= 1.1.13 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Updates vulnerability
Missing Authorization to Authenticated Subscriber+ Plugin Settings Updates vulnerability discovered by Lucio Sá in WordPress Plugin Booking Ultra Pro versions = 1.1.13...
WordPress LearnDash LMS - Reports Free plugin <= 1.8.2 - Missing Authorization to Plugin Settings Update vulnerability
WordPress LearnDash LMS - Reports Free plugin = 1.8.2 - Missing Authorization to Plugin Settings Update vulnerability discovered by Lucio Sá in WordPress Plugin LearnDash LMS – Reports versions = 1.8.2...
WordPress Simple Photoswipe plugin <= 0.1 - Subscriber+ Arbitrary Settings Update vulnerability
Subscriber+ Arbitrary Settings Update vulnerability discovered by Felipe Caon in WordPress Plugin Simple Photoswipe versions = 0.1...
PT-2024-37599 · WordPress · Floating Social Buttons
Name of the Vulnerable Software and Affected Versions: Floating Social Buttons plugin for WordPress versions up to, and including, 1.5 Description: The issue is due to missing or incorrect nonce validation on the floating social buttons option function, making it possible for unauthenticated...
CVE-2024-5570
The Simple Photoswipe WordPress plugin through 0.1 does not have authorisation check when updating its settings, which could allow any authenticated users, such as subscriber to update them...
CVE-2024-5570 Simple Photoswipe <= 0.1 - Subscriber+ Arbitrary Settings Update
The Simple Photoswipe WordPress plugin through 0.1 does not have authorisation check when updating its settings, which could allow any authenticated users, such as subscriber to update them...
PT-2024-36578 · WordPress · Simple Photoswipe
Name of the Vulnerable Software and Affected Versions: Simple Photoswipe WordPress plugin version 0.1 Description: The issue concerns a lack of authorization checks when updating settings, potentially allowing any authenticated user to modify them. Recommendations: For Simple Photoswipe WordPress...