505 matches found
CVE-2023-46190
CVE-2023-46190 affects the WordPress plugin Novo-map (Novo-Map) up to version 1.1.2. The issue is a Cross-Site Request Forgery (CSRF) vulnerability that, per sources, can be exploited with unauthenticated privileges to trigger actions on behalf of an authenticated user. Remediation: upgrade to a ...
CVE-2023-45747: Improper Neutralization of Input During Web Page Generation
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Syed Balkhi WP Lightbox 2 plugin = 3.0.6.5 versions...
CVE-2023-44257
CVE-2023-44257 (Mang Board WP Plugin) : CSRF vulnerability affects Mang Board WP plugin
CVE-2023-40671
Cross-Site Request Forgery CSRF vulnerability in 大侠wp DX-auto-save-images plugin = 1.4.0 versions...
CVE-2023-25463
CVE-2023-25463: CSRF in Gopi Ramasamy WP tell a friend popup form plugin (
WordPress Verbalize WP Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)
Software Verbalize WP Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 21e3ff2fe6c4 Credits Rafie Muhammad Patchstack Required...
Popup-Maker < 1.8.12 - Broken Authentication
An issue was discovered in the Popup Maker plugin before 1.8.13 for WordPress. An unauthenticated attacker can partially control the arguments of the doaction function to invoke certain popmake or pum methods, as demonstrated by controlling content and delivery of popmake-system-info.txt aka the...
CVE-2023-32964
Cross-Site Request Forgery CSRF vulnerability in Made with Fuel Better Notifications for WP plugin = 1.9.2 versions...
PT-2023-19117 · WordPress · Rvola Wp Original Media Path
Name of the Vulnerable Software and Affected Versions: RVOLA WP Original Media Path plugin versions = 2.4.0 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that affects authenticated administrators. This vulnerability allows for malicious script execution on t...
PT-2023-15419 · WordPress · Jeffrey-Wp Media Library Categories
Name of the Vulnerable Software and Affected Versions: Jeffrey-WP Media Library Categories plugin versions prior to 1.9.9 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability requires authentication with admin+ privileges. Recommendations: For...
CVE-2023-1088
The WP Plugin Manager WordPress plugin before 1.1.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack...
Cross site request forgery (csrf)
The WP Plugin Manager WordPress plugin before 1.1.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack...
CVE-2023-1088 WP Plugin Manager < 1.1.8 - Arbitrary Plugin Activation via CSRF
The WP Plugin Manager WordPress plugin before 1.1.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack...
CVE-2023-1088
CVE-2023-1088 affects WP Plugin Manager for WordPress prior to 1.1.8. The root cause is missing CSRF validation on plugin activation, enabling CSRF attackers to trigger activation of arbitrary plugins by logged-in admins. Public details consistently identify the vulnerable release range and the f...
CVE-2023-1088: Undefined Security Weakness
The WP Plugin Manager WordPress plugin before 1.1.8 does not have CSRF check when activating plugins, which could allow attackers to make logged in admins activate arbitrary plugins present on the blog via a CSRF attack...
CVE-2022-38063
Cross-Site Request Forgery CSRF vulnerability in Social Login WP plugin = 5.0.0.0 versions...
CVE-2022-38063
CVE-2022-38063 is a CSRF vulnerability reported in the WordPress plugin Social Login WP, affecting versions <= 5.0.0.0. The initial and connected sources consistently describe a Cross-Site Request Forgery issue in this plugin. The documents do not specify explicit exploitation steps or in-the-...
CVE-2023-23711
Cross-Site Request Forgery CSRF vulnerability in A2 Hosting A2 Optimized WP plugin = 3.0.4 versions...