25792 matches found
CVE-2024-8082
The Widgets Reset WordPress plugin (versions ≤ 0.1) contains a CSRF flaw in the settings update path caused by missing CSRF protection. This could enable a logged-in administrator to alter settings via a CSRF attack. Public materials identify the affected version, but none provide a confirmed pat...
CVE-2024-8094 Ntz Antispam <= 2.0e - Settings Update via CSRF
The Ntz Antispam WordPress plugin through 2.0e does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
CVE-2024-8094 Ntz Antispam <= 2.0e - Settings Update via CSRF
The Ntz Antispam WordPress plugin through 2.0e does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
CVE-2024-8082 Widgets Reset <= 0.1 - Settings Update via CSRF
The Widgets Reset WordPress plugin through 0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
CVE-2024-8050
CVE-2024-8050 : The Custom Author Base WordPress plugin (versions up to 1.1.1) lacks CSRF protection on its settings update action, enabling a logged-in admin to alter settings via CSRF. Connected sources corroborate the impact and vendor remediation path. Affected software: Custom Author Base pl...
CVE-2024-8050 Custom Author Base <= 1.1.1 - Settings Update via CSRF
The Custom Author Base WordPress plugin through 1.1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
CVE-2024-7984 Joy Of Text Lite – SMS messaging for WordPress <= 2.3.1 - Settings Update via CSRF
The Joy Of Text Lite WordPress plugin through 2.3.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
CVE-2024-8050 Custom Author Base <= 1.1.1 - Settings Update via CSRF
The Custom Author Base WordPress plugin through 1.1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
CVE-2024-7984
The CVE concerns the WordPress plugin Joy Of Text Lite (SMS messaging for WordPress) versions 2.3.1 and earlier. The vulnerability arises from a missing CSRF check when updating plugin settings, which could allow an attacker to cause a logged-in admin to change settings via CSRF. Exploitation det...
CVE-2024-7556 Wordpress Simple Share Plugin <=0.5.3 - Admin+ XSS
The Simple Share WordPress plugin through 0.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-6719
The CVE-2024-6719 entry concerns the WordPress plugin “Offload Videos” (bunny.net/AWS S3 integration) prior to version 1.0.1. According to the documentation, the vulnerability arises from a missing CSRF check when updating plugin settings, which could allow low-privilege users to alter settings v...
CVE-2024-13616
The CVE covers the VikBooking Hotel Booking Engine & PMS WordPress plugin (prior to version 1.7.2). The underlying issue is insufficient sanitization/escaping of certain plugin settings, enabling Stored Cross-Site Scripting even when unfiltered_html is disallowed (e.g., in multisite setups). Affe...
CVE-2024-13383
The CVE-2024-13383 entry concerns the WordPress HD Quiz plugin (pre-2.0.0). The root cause is lack of proper sanitisation/escaping of certain plugin settings, which can allow Stored Cross-Site Scripting (Stored XSS) by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (e...
CVE-2024-13382 Calculated Fields Form < 5.2.64 - Admin+ Stored XSS
The Calculated Fields Form WordPress plugin before 5.2.64 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-13313
CVE-2024-13313 affects the AWeber WordPress plugin up to version 7.3.20. The issue arises from unsanitised/uncleaned settings in the plugin, enabling Stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallowed, such as in multisite setups. Public sources identify the...
CVE-2024-13128
The CVE-2024-13128 entry concerns the LearnPress WordPress plugin prior to version 4.2.7.5.1. According to the provided documents, the vulnerability arises because the plugin does not sanitize and escape certain settings, which could allow high-privilege users (e.g., admins) to perform a Stored C...
CVE-2024-13053 Form Maker by 10Web < 1.15.33 - Admin+ Stored XSS via Theme Title
The Form Maker by 10Web WordPress plugin before 1.15.33 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-12874
The CVE-2024-12874 entry concerns the WordPress plugin Top Comments, affected up to version 1.0. The issue is caused by insufficient sanitization/escaping of certain settings, enabling Stored XSS by high-privilege admins (e.g., in multisite) even when unfiltered_html is disallowed. Public exploit...
CVE-2024-12750 Competition Form <= 2.0 - Competition Deletion via CSRF
The Competition Form WordPress plugin through 2.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...