Live News < 1.07 - Settings Update via CSRF

Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

Video Gallery & Management < 3.3.6 - Settings Update via CSRF

Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

Fraud Prevention For Woocommerce < 2.1.6 - Settings Update via CSRF

Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

Google Map Shortcode <= 3.1.2 - Settings Update via CSRF

Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

HTTP Auth < 1.0.0 - Settings Update via CSRF

Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

Realbig <= 1.0.6 - Settings Update via CSRF

Description The plugin does not have CSRF check in place when updating its settings as well as clear logs and cache, which could allow attackers to make a logged in admin change them via a CSRF attack...

CopyRightPro <= 2.1 - Settings Update via CSRF

Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

Woocommerce ESTO < 2.23.2 - Settings Update via CSRF

Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

Make Paths Relative <= 1.3.0 - Settings Update via CSRF

Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

MailMunch – Grow your Email List < 3.1.3 - Settings Update via CSRF

Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

wpCentral <= 1.5.7 - Settings Update via CSRF

Description The plugin does not have CSRF checks when updating allowed IP addresses and reseting connection key, which could allow attackers to make logged in admins perform such actions via CSRF attacks...

Responsive Gallery Grid <= 2.3.10 - Settings Update via CSRF

Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

WP-dTree <= 4.4.5 - Settings Update via CSRF

Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

WP Discord Invite < 2.5.1 - Arbitrary Settings Update via CSRF

Description The plugin does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to perform actions on their behalf by tricking a logged in administrator to submit a crafted request. alert1;'/...

CVE-2023-3510

The FTP Access WordPress plugin through 1.0 does not have authorisation and CSRF checks when updating its settings and is missing sanitisation as well as escaping in them, allowing any authenticated users, such as subscriber to update them with XSS payloads, which will be triggered when an admin...

PT-2023-25148 · WordPress · Ftp Access

Name of the Vulnerable Software and Affected Versions: FTP Access WordPress plugin versions 1.0 and earlier Description: The issue concerns a lack of authorization and CSRF checks when updating settings in the plugin, along with missing sanitization and escaping. This allows any authenticated use...

CVE-2023-3510: Undefined Security Weakness

The FTP Access WordPress plugin through 1.0 does not have authorisation and CSRF checks when updating its settings and is missing sanitisation as well as escaping in them, allowing any authenticated users, such as subscriber to update them with XSS payloads, which will be triggered when an admin...

CVE-2023-2353 CHP Ads Block Detector <= 3.9.4 - Missing Authorization to Plugin Settings Update

The CHP Ads Block Detector plugin for WordPress is vulnerable to unauthorized plugin settings update and reset due to a missing capability check on the chpabdaction function in versions up to, and including, 3.9.4. This makes it possible for subscriber-level attackers to change or reset plugin...

CVE-2023-2353 CHP Ads Block Detector <= 3.9.4 - Missing Authorization to Plugin Settings Update

The CHP Ads Block Detector plugin for WordPress is vulnerable to unauthorized plugin settings update and reset due to a missing capability check on the chpabdaction function in versions up to, and including, 3.9.4. This makes it possible for subscriber-level attackers to change or reset plugin...

CVE-2023-2353

The CHP Ads Block Detector WordPress plugin (versions up to 3.9.4) is vulnerable due to a missing capability check in chp_abd_action, allowing subscriber‑level attackers to modify or reset plugin settings. This CVE (CVE-2023-2353) and the duplicate CVE-2023-36509 are described with this root caus...