PT-2019-7408

Name of the Vulnerable Software and Affected Versions microblog-poster plugin versions prior to 1.6.2 Description The issue allows for SQL Injection via the account id parameter in the "wp-admin/options-general.php?page=microblogposter.php" API endpoint. Recommendations For versions prior to 1.6....

PT-2019-7400

Name of the Vulnerable Software and Affected Versions Bookmarkify plugin version 2.9.2 for WordPress Description The issue concerns a CSRF vulnerability that leads to XSS. It is exploited via the "wp-admin/options-general.php?page=bookmarkify.php" API endpoint. Recommendations For Bookmarkify...

CVE-2015-9408: Cross-Site Request Forgery (CSRF)

The xpinner-lite plugin through 2.2 for WordPress has wp-admin/options-general.php CSRF with resultant XSS...

CVE-2015-9387: Cross-Site Request Forgery (CSRF)

The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/options-general.php CSRF...

PT-2019-7346

Name of the Vulnerable Software and Affected Versions mtouch-quiz plugin versions prior to 3.1.3 for WordPress Description The issue concerns a CSRF vulnerability in the wp-admin/options-general.php endpoint. This allows for potential unauthorized actions. No information is provided about the...

PT-2019-7367

Name of the Vulnerable Software and Affected Versions xpinner-lite plugin versions through 2.2 for WordPress Description The issue concerns a CSRF vulnerability with resultant XSS in the wp-admin/options-general.php endpoint. This allows for cross-site request forgery attacks that can lead to...

CVE-2017-18521

The democracy-poll plugin before 5.4 for WordPress has CSRF via wp-admin/options-general.php?page=democracy-poll&subpage=l10n...

CVE-2017-18521: Cross-Site Request Forgery (CSRF)

The democracy-poll plugin before 5.4 for WordPress has CSRF via wp-admin/options-general.php?page=democracy-poll&subpage=l10n...

PT-2019-8455

Name of the Vulnerable Software and Affected Versions democracy-poll plugin versions prior to 5.4 Description The issue concerns a CSRF problem. It can be exploited via the "wp-admin/options-general.php?page=democracy-poll&subpage=l10n" API endpoint. Recommendations For versions prior to 5.4,...

CVE-2019-14682

The acf-better-search aka ACF: Better Search plugin before 3.3.1 for WordPress allows wp-admin/options-general.php?page=acfbsadminpage CSRF...

CVE-2019-14681: Cross-Site Request Forgery (CSRF)

The Deny All Firewall plugin before 1.1.7 for WordPress allows wp-admin/options-general.php?page=dafsettings&dafremove=true CSRF...

PT-2019-13777

Name of the Vulnerable Software and Affected Versions Deny All Firewall plugin versions prior to 1.1.7 Description The issue allows for a CSRF attack via the wp-admin/options-general.php?page=daf settings&daf remove=true endpoint, potentially affecting the security of WordPress installations usin...

PT-2019-13778

Name of the Vulnerable Software and Affected Versions acf-better-search plugin versions prior to 3.3.1 Description The issue allows for a CSRF attack via the wp-admin/options-general.php?page=acfbs admin page endpoint. Recommendations For acf-better-search plugin versions prior to 3.3.1, update t...

CVE-2019-14682: Cross-Site Request Forgery (CSRF)

The acf-better-search aka ACF: Better Search plugin before 3.3.1 for WordPress allows wp-admin/options-general.php?page=acfbsadminpage CSRF...

PT-2019-13033

Name of the Vulnerable Software and Affected Versions wp-code-highlightjs plugin through 0.6.2 for WordPress Description An issue was discovered that allows CSRF, as demonstrated by an XSS payload in the hljs additional css parameter, via the "wp-admin/options-general.php?page=wp-code-highlight-j...

CVE-2019-9908: Improper Neutralization of Input During Web Page Generation

The font-organizer plugin 2.1.1 for WordPress has wp-admin/options-general.php managefontid XSS...

PT-2019-19926

Name of the Vulnerable Software and Affected Versions WordPress font-organizer plugin version 2.1.1 Description The issue concerns a Cross-Site Scripting XSS vulnerability in the font-organizer plugin for WordPress, specifically affecting the management of font IDs through the...

CVE-2014-5034: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the Brute Force Login Protection module 1.3 for WordPress allows remote attackers to hijack the authentication of unspecified users for requests that have unknown impact via a crafted request to the brute-force-login-protection page to...

PT-2018-4206

Name of the Vulnerable Software and Affected Versions WP HTML Sitemap plugin version 1.2 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that delete the sitemap via a request to the "wp-html-sitemap" page in...

CVE-2014-2550: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the Disable Comments plugin before 1.0.4 for WordPress allows remote attackers to hijack the authentication of administrators for requests that enable comments via a request to the disablecommentssettings page to wp-admin/options-general.php...