CVE-2022-25602

Nonce token leak vulnerability leading to arbitrary file upload, theme deletion, plugin settings change discovered in Responsive Menu WordPress plugin versions = 4.1.7...

CVE-2022-25602 WordPress Responsive Menu plugin <= 4.1.7 - Nonce token leak leading to arbitrary file upload, theme deletion, plugin settings change vulnerability

Nonce token leak vulnerability leading to arbitrary file upload, theme deletion, plugin settings change discovered in Responsive Menu WordPress plugin versions = 4.1.7...

CVE-2022-25602 WordPress Responsive Menu plugin <= 4.1.7 - Nonce token leak leading to arbitrary file upload, theme deletion, plugin settings change vulnerability

Nonce token leak vulnerability leading to arbitrary file upload, theme deletion, plugin settings change discovered in Responsive Menu WordPress plugin versions = 4.1.7...

CVE-2022-25602

CVE-2022-25602 affects the WordPress Responsive Menu plugin (versions ≤ 4.1.7). A nonce token leak enables arbitrary file upload, theme deletion, and plugin settings changes. Multiple connected sources (Patchstack, WPVulndb, NVD/NVD-derived entries) corroborate the impact and prioritization as a ...

WordPress Responsive Menu plugin <= 4.1.7 - Nonce token leak leading to arbitrary file upload, theme deletion, plugin settings change vulnerability

Nonce token leak leading to arbitrary file upload, theme deletion, plugin settings change vulnerability discovered by Dave Jong Patchstack in WordPress Responsive Menu plugin versions = 4.1.7. Solution Update the WordPress Responsive Menu plugin to the latest available version at least 4.1.8...

CVE-2022-27855

Cross-Site Request Forgery CSRF vulnerability in Fatcat Apps Analytics Cat plugin = 1.0.9 on WordPress allows Plugin Settings Change...

CVE-2022-22804

A CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists that could allow an authenticated attacker to view data, change settings, or impact availability of the software when the user visits a page containing the injected payload. Affected...

WordPress PublishPress Capabilities plugin <= 2.3 - Unauthenticated Settings Change vulnerability

Unauthenticated Settings Change vulnerability discovered by Krzysztof Zając in WordPress PublishPress Capabilities plugin versions = 2.3. Solution Update the WordPress PublishPress Capabilities plugin to the latest available version at least 2.3.1...

CVE-2021-42539

The affected product is vulnerable to a missing permission validation on system backup restore, which could lead to account take over and unapproved settings change...

Design/Logic Flaw

The affected product is vulnerable to a missing permission validation on system backup restore, which could lead to account take over and unapproved settings change...

CVE-2021-42539

The CVE-2021-42539 issue affects Emerson WirelessHART Gateway devices (WirelessHART 1410, 1410D, 1420 gateways) with firmware versions prior to 4.7.94. The root cause is missing authentication/permission validation during system backup restore, enabling a low-privileged attacker to perform action...

CVE-2021-42539 Emerson WirelessHART Gateway

The affected product is vulnerable to a missing permission validation on system backup restore, which could lead to account take over and unapproved settings change...

WP Performance Score Booster < 2.1 - Settings Change via CSRF

The plugin does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. PoC...

WP Performance Score Booster < 2.1 - Settings Change via CSRF

The plugin does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. csrf.submit...

WordPress WP Performance Score Booster plugin <= 2.0 - Cross-Site Request Forgery (CSRF) vulnerability leading to Settings Change

Cross-Site Request Forgery CSRF vulnerability leading to Settings Change discovered by apple502j in WordPress WP Performance Score Booster plugin versions = 2.0. Solution Update the WordPress WP Performance Score Booster plugin to the latest available version at least 2.1...

Cross-Site Request Forgery (CSRF) in pkp/ojs

Description No CSRF token in DataCite save settings plugin OJS only POC document.forms0.submit; Impact This vulnerability is capable of tricking admins to change settings for OJS DataCite plugin...

WordPress JobSearch premium plugin <= 1.8.1 - Unauthenticated Settings Change vulnerability

Unauthenticated Settings Change vulnerability discovered by Jerome Bruandet NinTechNet in WordPress JobSearch premium plugin versions = 1.8.1. Solution Update the WordPress JobSearch premium plugin to the latest available version at least 1.8.2...

WordPress Getwid – Gutenberg Blocks plugin <= 1.7.4 - Cross-Site Request Forgery (CSRF) / Settings Change vulnerability

Cross-Site Request Forgery CSRF / Settings Change vulnerability discovered in WordPress Getwid – Gutenberg Blocks plugin versions = 1.7.4. Solution Update the WordPress Getwid – Gutenberg Blocks plugin to the latest available version at least 1.7.7...

WordPress Warranties and Returns for WooCommerce plugin <= 5.2.1 - Multiple vulnerabilities

Multiple vulnerabilities Authenticated Arbitrary WordPress Options Change, Read and Deletion / Authenticated User Enumeration / Authenticated Plugin Settings Change, Import and Export were discovered by Jerome Bruandet NinTechNet in WordPress Warranties and Returns for WooCommerce plugin versions...

WordPress Price Commander for WooCommerce plugin <= 1.2.1 - Multiple vulnerabilities

Multiple vulnerabilities Authenticated Arbitrary WordPress Options Change, Read and Deletion / Authenticated User Enumeration / Authenticated Plugin Settings Change, Import and Export were discovered by Jerome Bruandet NinTechNet in WordPress Price Commander for WooCommerce plugin versions = 1.2....