CVE-2024-9236 Team Members Showcase < 4.4.2 - Editor+ Stored XSS

The Team WordPress plugin before 4.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-9233 GS Logo Slider < 3.7.1 - Settings Update via Cross-Site Request Forgery

The Logo Slider WordPress plugin before 3.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-9182

The CVE-2024-9182 issue affects the Maspik WordPress plugin, specifically versions prior to 2.1.3. The vulnerability arises because the plugin does not adequately sanitize and escape certain settings, enabling stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallow...

CVE-2024-8854

The CVE-2024-8854 entry concerns the Polls CP WordPress plugin (versions prior to 1.0.77). The vulnerability arises because the plugin does not sanitize and escape certain poll settings, enabling stored cross-site scripting via admin-level actions, even when unfiltered_html is disallowed (e.g., i...

CVE-2024-9182 Maspik - Advanced Spam protection < 2.1.3 - Admin+ Stored XSS

The Maspik WordPress plugin before 2.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2024-9227 PowerPress Podcasting < 11.9.18 - Author+ XSS

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.9.18 does not sanitise and escape some of its settings when adding a podcast, which could allow admin users to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2024-8702 Backup Database <= 4.9 - Admin+ Stored XSS

The Backup Database WordPress plugin through 4.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-8619

The CVE-2024-8619 entry concerns the WordPress plugin Ajax Search Lite, affected version(s) prior to 4.12.3. The root cause is inadequate sanitisation/escaping of certain settings, which could enable a stored cross-site scripting (Stored XSS) attack by high-privilege users (e.g., admins) even whe...

CVE-2024-8398 Simple Nav Archives <= 2.1.3 - Settings Update via CSRF

The Simple Nav Archives WordPress plugin through 2.1.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-8398

Summary: CVE-2024-8398 affects the WordPress plugin Simple Nav Archives, versions

CVE-2024-8398 Simple Nav Archives <= 2.1.3 - Settings Update via CSRF

The Simple Nav Archives WordPress plugin through 2.1.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-8245 GamiPress - Reset User <= 1.0.0 - GamiPress User Data Removal via CSRF

The GamiPress WordPress plugin before 1.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-8245

The CVE concerns the GamiPress WordPress plugin prior to version 1.0.1, where a missing CSRF check when updating settings allows a logged‑in attacker to change settings via a CSRF attack. Affected product: GamiPress WordPress plugin (pre‑1.0.1). Root cause: no CSRF protection on settings updates....

CVE-2024-8094

The CVE-2024-8094 entry identifies a CSRF flaw in the Ntz Antispam WordPress plugin (versions up to 2.0e) where the settings update flow lacks CSRF protection. Root cause: missing CSRF check when updating plugin settings. Impact: a CSRF attack could cause a logged-in admin to change settings. Pub...

CVE-2024-8082 Widgets Reset <= 0.1 - Settings Update via CSRF

The Widgets Reset WordPress plugin through 0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-8082

The Widgets Reset WordPress plugin (versions ≤ 0.1) contains a CSRF flaw in the settings update path caused by missing CSRF protection. This could enable a logged-in administrator to alter settings via a CSRF attack. Public materials identify the affected version, but none provide a confirmed pat...

CVE-2024-8094 Ntz Antispam <= 2.0e - Settings Update via CSRF

The Ntz Antispam WordPress plugin through 2.0e does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-8094 Ntz Antispam <= 2.0e - Settings Update via CSRF

The Ntz Antispam WordPress plugin through 2.0e does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-8082 Widgets Reset <= 0.1 - Settings Update via CSRF

The Widgets Reset WordPress plugin through 0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-8050

CVE-2024-8050 : The Custom Author Base WordPress plugin (versions up to 1.1.1) lacks CSRF protection on its settings update action, enabling a logged-in admin to alter settings via CSRF. Connected sources corroborate the impact and vendor remediation path. Affected software: Custom Author Base pl...