Cross site request forgery (csrf)

The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on the queueposts function. This makes it possible for unauthenticated attackers to modify the...

PT-2023-16915

Name of the Vulnerable Software and Affected Versions RapidLoad Power-Up for Autoptimize plugin for WordPress versions up to, and including, 1.7.1 Description The issue is due to missing or incorrect nonce validation on the clear page cache function, making it possible for unauthenticated attacke...

WordPress WPCode - Insert Headers and Footers Plugin < 2.0.7 Improper Authorization Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wpcode:wpcode"; ifdescription...

WordPress Complianz – GDPR/CCPA Cookie Consent Plugin < 6.4.2 is vulnerable to Cross Site Scripting (XSS)

Software Complianz – GDPR/CCPA Cookie Consent Type Plugin Vulnerable versions 6.4.2 Fixed in 6.4.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-1069 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 624d8c17b2e4 Credits...

WordPress Postmatic Plugin < 2.2.10 is vulnerable to PHP Object Injection

Software Postmatic Type Plugin Vulnerable versions 2.2.10 Fixed in 2.2.10 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2022-4265 Patch priority High CVSS severity High 7.4 Developer Claim ownership PSID 96f8ea22622f Credits Lana Codes Required privilege Subscriber...

PT-2023-19775 · Funadmin · Funadmin

Name of the Vulnerable Software and Affected Versions: Funadmin version 3.2.0 Description: The issue is related to a remote code execution RCE vulnerability. It affects the controllerAddon.php component, allowing for potential exploitation. Recommendations: For Funadmin version 3.2.0, update to a...

PT-2023-16807 · Fabulatech · Fabulatech Webcam For Remote Desktop

Name of the Vulnerable Software and Affected Versions: FabulaTech Webcam for Remote Desktop version 2.8.42 Description: A vulnerability has been found in the library ftwebcam.sys of the component IOCTL Handler, affecting the function 0x222010/0x222018. The manipulation leads to null pointer...

WordPress HT Slider For Elementor Plugin < 1.4.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software HT Slider For Elementor Type Plugin Vulnerable versions 1.4.0 Fixed in 1.4.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-0495 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID fea57db2be31 Credits Lana Codes...

PT-2023-9865 · Unknown · Email Registration

Name of the Vulnerable Software and Affected Versions: Email Registration versions 5.x-2.1 Description: A critical issue affects the email registration user function of the email registration.module file. The manipulation of the namenew argument leads to SQL injection. The attack can be initiated...

WordPress DecaLog Plugin <= 3.7.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software DecaLog Type Plugin Vulnerable versions = 3.7.0 Fixed in 3.7.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-27444 Patch priority Low CVSS severity Low 4.3 Developer PerfOps One PSID 721ad967e10d Credits Mika Required privilege...

WordPress Blog Floating Button Plugin <= 1.4.12 is vulnerable to Cross Site Request Forgery (CSRF)

Software Blog Floating Button Type Plugin Vulnerable versions = 1.4.12 Fixed in 1.4.13 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-27445 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 7093cf42235a Credits Rio Darmawan...

WordPress WooSupply – Suppliers, Supply Orders and Stock Management Plugin <= 1.2.2 is vulnerable to Server Side Request Forgery (SSRF)

Software WooSupply – Suppliers, Supply Orders and Stock Management Type Plugin Vulnerable versions = 1.2.2 Fixed in N/A OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2022-40700 Patch priority Low CVSS severity Low 8.2 Developer Claim ownership PSID f4ff6d9dbad...

WordPress Resume Builder Plugin <= 3.1.1 is vulnerable to Cross Site Scripting (XSS)

Software Resume Builder Type Plugin Vulnerable versions = 3.1.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0078 Patch priority High CVSS severity High 6.5 Developer Claim ownership PSID 20cd873c2df4 Credits Lana Codes Required...

WordPress Elegant Custom Fonts Plugin <= 1.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Elegant Custom Fonts Type Plugin Vulnerable versions = 1.0 Fixed in 1.0.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-27436 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID e6a5548377b4 Credits Rio Darmawan...

WordPress Admin CSS MU Plugin <= 2.6 is vulnerable to Server Side Request Forgery (SSRF)

Software Admin CSS MU Type Plugin Vulnerable versions = 2.6 Fixed in 2.7 OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2022-40700 Patch priority Low CVSS severity Low 8.2 Developer Claim ownership PSID f8576e8732f6 Credits Dave Jong Patchstack Required privile...

WordPress New Adman Plugin <= 1.6.8 is vulnerable to Cross Site Scripting (XSS)

Software New Adman Type Plugin Vulnerable versions = 1.6.8 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-27439 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID b28d3bea3ea7 Credits Rio Darmawan Required privilege...

WordPress Resize at Upload Plus Plugin <= 1.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Resize at Upload Plus Type Plugin Vulnerable versions = 1.3 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-25467 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID cded0be39625 Credits Mika Required...

WordPress Types Plugin <= 3.4.17 is vulnerable to Arbitrary File Upload

Software Types Type Plugin Vulnerable versions = 3.4.17 Fixed in 3.4.18 OWASP Top 10 A6: Security Misconfiguration Classification Arbitrary File Upload CVE CVE-2023-27440 Patch priority Low CVSS severity Low 7.2 Developer Claim ownership PSID f01af6037806 Credits Dave Jong Patchstack Required...

WordPress UpQode Google Maps Plugin <= 1.0.5 is vulnerable to Cross Site Scripting (XSS)

Software UpQode Google Maps Type Plugin Vulnerable versions = 1.0.5 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0094 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 983dbcd3ed03 Credits Lana Codes Requir...

WordPress WooVIP – Membership plugin for WordPress and WooCommerce Plugin <= 1.4.4 is vulnerable to Server Side Request Forgery (SSRF)

Software WooVIP – Membership plugin for WordPress and WooCommerce Type Plugin Vulnerable versions = 1.4.4 Fixed in N/A OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2022-40700 Patch priority Low CVSS severity Low 8.2 Developer Claim ownership PSID f21710078bd7...