CVE-2023-7229 illi Link Party! <= 1.0 - Settings Update via CSRF

The illi Link Party! WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2023-7195 WP-Reply Notify <= 1.1 - Settings Update via CSRF

The WP-Reply Notify WordPress plugin through 1.1 does not have a CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack...

CVE-2023-7195 WP-Reply Notify <= 1.1 - Settings Update via CSRF

The WP-Reply Notify WordPress plugin through 1.1 does not have a CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack...

CVE-2023-7196 Ultimate Noindex Nofollow Tool <= 1.1.2 - Settings Update via CSRF

The Ultimate Noindex Nofollow Tool WordPress plugin through 1.1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2023-7168 Better Follow Button for Jetpack <= 8.0 - Admin+ Stored XSS

The Better Follow Button for Jetpack WordPress plugin through 8.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite...

CVE-2023-5934 Travelpayouts < 1.1.13 - Settings Update via CSRF

The Travelpayouts: All Travel Brands in One Place WordPress plugin before 1.1.13 does not have CSRF check in place when importing settings from the v1, which could allow attackers to make a logged in admin update some settings via a CSRF attack...

CVE-2023-5934 Travelpayouts < 1.1.13 - Settings Update via CSRF

The Travelpayouts: All Travel Brands in One Place WordPress plugin before 1.1.13 does not have CSRF check in place when importing settings from the v1, which could allow attackers to make a logged in admin update some settings via a CSRF attack...

CVE-2025-2247 WP-PManager <= 1.2 - Category Deletion via CSRF

The WP-PManager WordPress plugin through 1.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2025-1454 Ninja Pages <= 1.4.2 - Admin+ Stored XSS

The Ninja Pages WordPress plugin through 1.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2025-1033 Badgearoo <= 1.0.14 - Admin+ Stored XSS

The Badgearoo WordPress plugin through 1.0.14 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2025-0329 AI ChatBot for WordPress – WPBot < 6.2.4 - Admin+ Stored XSS

The AI ChatBot for WordPress WordPress plugin before 6.2.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-9709 EKC Tournament Manager < 2.2.2 - Create Tournaments/Teams via CSRF

The EKC Tournament Manager WordPress plugin before 2.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-9709 EKC Tournament Manager < 2.2.2 - Create Tournaments/Teams via CSRF

The EKC Tournament Manager WordPress plugin before 2.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-9711

The CVE relates to the WordPress EKC Tournament Manager plugin prior to version 2.2.2. Affected component: the plugin’s settings update workflow. Root cause: absence of CSRF protection when updating settings, enabling a logged-in attacker to alter settings via a CSRF attack. Impact stated across ...

CVE-2024-9709 EKC Tournament Manager < 2.2.2 - Create Tournaments/Teams via CSRF

The EKC Tournament Manager WordPress plugin before 2.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-9599

CVE-2024-9599 affects the WordPress Popup Box plugin prior to version 4.7.8. The vulnerability stems from not sanitising/escaping certain settings, enabling stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (e.g., in multisite). CVSSv3.1 base score 5.4 (Med...

CVE-2024-9450 Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking < 1.3.15 - Subscriber+ PayPal Settings Update

The Free Booking Plugin for Hotels, Restaurants and Car Rentals WordPress plugin before 1.3.15 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in subscriber change them via a CSRF attack...

CVE-2024-9236

CVE-2024-9236 affects the WordPress plugin Team Members Showcase (Team) prior to version 4.4.2. The issue arises because the plugin does not sanitize and escape some settings, enabling Stored Cross-Site Scripting (Stored XSS) by high-privilege users (e.g., admins), even when the unfiltered_html c...

CVE-2024-9233

CVE-2024-9233 concerns the Logo Slider WordPress plugin, versions prior to 3.7.1. The public description and Red Hat/NVD entries confirm a lack of CSRF protection when updating plugin settings, potentially allowing a logged-in admin to be coerced into changing settings via CSRF. The vulnerability...

CVE-2024-9233 GS Logo Slider < 3.7.1 - Settings Update via Cross-Site Request Forgery

The Logo Slider WordPress plugin before 3.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...