CVE-2024-2322

The WooCommerce Cart Abandonment Recovery WordPress plugin before 1.2.27 does not have CSRF check in its bulk actions, which could allow attackers to make logged in admins delete arbitrary email templates as well as delete and unsubscribe users from abandoned orders via CSRF attacks...

CVE-2024-2322 WooCommerce Cart Abandonment Recovery < 1.2.27 - Templates/Abandoned Orders Deletion via CSRF

The WooCommerce Cart Abandonment Recovery WordPress plugin before 1.2.27 does not have CSRF check in its bulk actions, which could allow attackers to make logged in admins delete arbitrary email templates as well as delete and unsubscribe users from abandoned orders via CSRF attacks...

WooCommerce Cart Abandonment Recovery < 1.2.27 - Templates/Abandoned Orders Deletion via CSRF

Description The plugin does not have CSRF check in its bulk actions, which could allow attackers to make logged in admins delete arbitrary email templates as well as delete and unsubscribe users from abandoned orders via CSRF attacks. PoC Make a logged in admin open one of the URLs below - To mak...

PT-2024-19720 · WordPress · Recover Woocommerce Cart Abandonment

Name of the Vulnerable Software and Affected Versions: WooCommerce Cart Abandonment Recovery WordPress plugin versions prior to 1.2.27 Description: The issue concerns a lack of CSRF check in bulk actions, which could allow attackers to make logged-in admins delete arbitrary email templates as wel...

Contao Cross-site Scripting vulnerabililty

Contao 3.x before 3.5.32 allows Cross-site Scripting XSS via the unsubscribe module in the frontend newsletter extension...

GHSA-MPG7-2RX9-H5QP Contao Cross-site Scripting vulnerabililty

Contao 3.x before 3.5.32 allows Cross-site Scripting XSS via the unsubscribe module in the frontend newsletter extension...

CVE-2018-5478

Contao 3.x before 3.5.32 allows XSS via the unsubscribe module in the frontend newsletter extension...

CVE-2018-5478

Contao 3.x before 3.5.32 allows XSS via the unsubscribe module in the frontend newsletter extension...

Design/Logic Flaw

Contao 3.x before 3.5.32 allows XSS via the unsubscribe module in the frontend newsletter extension...

Contao Cross-Site Scripting Vulnerability

Contao is an open source content management system CMS developed using PHP. The system supports search engines, rights management, and CSS frameworks. A security vulnerability exists in version 3.x prior to Contao version 3.5.32, which originates from a cross-site scripting attack via the...

CVE-2018-5478

Contao 3.x before 3.5.32 allows XSS via the unsubscribe module in the frontend newsletter extension...

CVE-2018-5478

CVE-2018-5478 affects Contao 3.x up to 3.5.31. The vulnerability is a Cross-Site Scripting (XSS) flaw in the frontend newsletter extension's unsubscribe module, arising from inadequate input handling in that component. Impact is XSS in environments using Contao 3.x with the unsubscribe feature en...

CVE-2018-5478

Contao 3.x before 3.5.32 allows XSS via the unsubscribe module in the frontend newsletter extension...

Mars: Google dork lead to unsubscribe anyone from all Banfield emails

The vulnerability allowed an attacker to unsubscribe any Banfield user from their emails without authentication or authorization. The vulnerability was discovered through a Google dork search that led to an endpoint where the attacker could provide an email address to unsubscribe the user...

CVE-2023-1430

The FluentCRM - Marketing Automation For WordPress plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 2.7.40 due to the use of an MD5 hash without a salt to control subscriptions. This makes it possible for unauthenticated attackers to...

CVE-2023-1430

The FluentCRM - Marketing Automation For WordPress plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 2.7.40 due to the use of an MD5 hash without a salt to control subscriptions. This makes it possible for unauthenticated attackers to...

CVE-2023-1430

The FluentCRM - Marketing Automation For WordPress plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 2.8.01 due to the use of an MD5 hash without a salt to control subscriptions. This makes it possible for unauthenticated attackers to...

Mozilla: HTML Injection at https://stage.firefoxmonitor.nonprod.cloudops.mozgcp.net/user/unsubscribe

An HTML injection vulnerability was discovered on the "Unsubscribe" page of the website. This vulnerability allowed an attacker to inject malicious code, potentially leading to various attacks against users of the application...

SUSE CVE-2021-20236

A flaw was found in the ZeroMQ server in versions before 4.3.3. This flaw allows a malicious client to cause a stack buffer overflow on the server by sending crafted topic subscription requests and then unsubscribing. The highest threat from this vulnerability is to confidentiality, integrity, as...

SUSE CVE-2021-40347

An issue was discovered in views/list.py in GNU Mailman Postorius before 1.3.5. An attacker logged into any account can send a crafted POST request to unsubscribe any user from a mailing list, also revealing whether that address was subscribed in the first place...