Email Marketing for WooCommerce by Omnisend < 1.14.4 - Cross-Site Request Forgery

Description The Email Marketing for WooCommerce by Omnisend plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.14.3. This is due to missing or incorrect nonce validation on the 'logoptions' action. This makes it possible for unauthenticated...

AffiEasy < 1.1.6 - Cross-Site Request Forgery

Description The AffiEasy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.4. This is due to missing or incorrect nonce validation on the delete-table action. This makes it possible for unauthenticated attackers to delete tables via a forged...

BEAF < 4.5.5 - Cross-Site Request Forgery to Notice Dismissal

Description The BEAF plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.4. This is due to missing or incorrect nonce validation on the bafgnewfeaturenoticedismissed function. This makes it possible for unauthenticated attackers to dismiss notice...

AWP Classifieds < 4.3.2 - Cross-Site Request Forgery

Description The AWP Classifieds plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.3.1. This is due to missing or incorrect nonce validation on the ajax function. This makes it possible for unauthenticated attackers to edit balances via a forged...

WpTravelly < 1.6.1 - Cross-Site Request Forgery

Description The WpTravelly plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.0. This is due to missing or incorrect nonce validation on the quicksetup function. This makes it possible for unauthenticated attackers to trigger a set-up via a forg...

Zoho Campaigns < 2.0.8 - Cross-Site Request Forgery via zcwc_integration_disconnect

Description The Zoho Campaigns plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.7. This is due to missing or incorrect nonce validation on the zcwcintegrationdisconnect function. This makes it possible for unauthenticated attackers to disconne...

EZ Form Calculator <= 2.14.0.3 - Reflected Cross-Site Scripting

Description The EZ Form Calculator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.14.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

Before And After <= 3.9 - Cross-Site Request Forgery

Description The Before And After plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.9. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a...

Otter Blocks < 2.6.10 - Contributor+ Stored XSS via titleTag

Description The plugin is vulnerable to Stored Cross-Site Scripting via the plugin's Post Grid widget due to insufficient input sanitization and output escaping on user supplied attributes such as 'titleTag'. This makes it possible for authenticated attackers, with contributor-level access and...

HT Mega < 2.4.7 - Contributor+ Stored XSS via Lightbox Widget

Description The plugin is vulnerable to Stored Cross-Site Scripting via the plugin's lightbox widget due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject...

Crony Cronjob Manager <= 0.5.0 - Cross-Site Request Forgery

Description The Crony Cronjob Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5.0. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an unkno...

Legal Pages < 1.4.3 - Cross-Site Request Forgery

Description The Legal Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.2. This is due to missing or incorrect nonce validation on the uninstallreasonsubmission function. This makes it possible for unauthenticated attackers to submit an...

WP Show Posts < 1.1.6 - Improper Authorization to Information Exposure

Description The WP Show Posts plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple AJAX functions in all versions up to, and including, 1.1.5. This makes it possible for authenticated attackers, with subscriber access and above, to view...

Easy Contact Form Lite < 1.1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The Easy Contact Form Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.1.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above...

WP Google Analytics Events < 2.8.1 - Reflected Cross-Site Scripting

Description The WP Google Analytics Events – No-Code Custom Event Tracking for Google Analytics plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 2.8.0 due to insufficient input sanitization and output escaping. This makes it possible for...

Podlove Podcast Publisher < 4.1.1 - Missing Authorization

Description The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions such as dorepair in versions up to, and including, 4.1.0. This makes it possible for authenticated attackers, with subscriber-level access and...

Siteimprove < 2.0.7 - Cross-Site Request Forgery

Description The Siteimprove plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.6. This is due to missing or incorrect nonce validation on two functions. This makes it possible for unauthenticated attackers to request a token via a forged request...

WP Meta SEO < 4.5.13 - Unauthenticated Password Protected Content Access

Description The plugin is vulnerable to Sensitive Information Exposure via the meta description, allowing unauthenticated attackers to disclose potentially sensitive information via the meta description of password-protected posts...

Zoho Campaigns < 2.0.7 - Authenticated (Contributor+) SQL Injection

Description The Zoho Campaigns plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.0.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated...

HT Mega < 2.5.0 - Contributor+ Stored XSS via Countdown Widget

Description The plugin is vulnerable to Stored Cross-Site Scripting via the Countdown widget's attributes due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or above, to inject arbitrary web scripts in pages that...

Redirection < 1.2.0 - Subscriber+ Unauthorised Action Calls

Description The plugin is vulnerable to unauthorized access due to a missing capability check on several functions, allowing authenticated attackers, with subscriber-level access and above, to perform unauthorized actions...

eCommerce Product Catalog < 3.3.29 - Cross-Site Request Forgery

Description The eCommerce Product Catalog plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3.28. This is due to missing or incorrect nonce validation on the handlemode function. This makes it possible for unauthenticated attackers to change mode...

Leadinfo < 1.1 - Settings Update via CSRF

Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

Finale Lite < 2.18.1 - Cross-Site Request Forgery

Description The Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.18.0. This is due to missing or incorrect nonce validation on the xlooptincall function. This makes it possible f...

GEO my WordPress < 4.2 - Cross-Site Request Forgery

Description The GEO my WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform unauthorized actions via a...

WebinarIgnition < 3.06.0 - Cross-Site Request Forgery

Description The WebinarIgnition plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.05.8. This is due to missing or incorrect nonce validation on the delete action. This makes it possible for unauthenticated attackers to delete settings via a forge...

Novelist < 1.2.3 - Cross-Site Request Forgery

Description The Novelist plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.2. This is due to missing or incorrect nonce validation on the novelistrestoredefaultsettings function. This makes it possible for unauthenticated attackers to restore t...

Gift Vouchers < 4.4.1 - Cross-Site Request Forgery

Description The Gift Vouchers plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.4.0. This is due to missing or incorrect nonce validation on the createdefaultpages function. This makes it possible for unauthenticated attackers to trigger the...

Order Delivery Date for WooCommerce < 3.21.1 - Cross-Site Request Forgery to Notice Dismissal

Description The Order Delivery Date for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.21.0. This is due to missing or incorrect nonce validation on the dismissnotice function. This makes it possible for unauthenticated attackers t...

RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator < 4.4.8 - Authenticated(Contributor+) Blind Server-Side Request Forgery (SSRF)

Description The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 4.4.7 via the fetchfeed functionality. This makes it possible for authenticate...

Jobs for WordPress < 2.7.6 - Reflected Cross-Site Scripting via job-search

Description The Jobs for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘job-search’ parameter in all versions up to, and including, 2.7.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

Sangar Slider <= 1.3.2 - Cross-Site Request Forgery

Description The Responsive Slider – Sangar Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.2. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to...

Pardot < 2.1.1 - Missing Authorization

Description The Pardot plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX actions in versions up to, and including, 2.1.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to reset cache among othe...

HT Mega < 2.4.7 - Unauthenticated Order Data Disclosure

Description The plugin is vulnerable to Sensitive Information Exposure via the purchasedproducts function, allowing unauthenticatied attackers to extract sensitive data including the previous 7 days of order data including products and customer PII...

MultiParcels Shipping For WooCommerce < 1.16.9 - Cross-Site Request Forgery

Description The MultiParcels Shipping For WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to 1.16.9 exclusive. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perfo...

EAN for WooCommerce < 4.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via alg_wc_ean_product_meta Shortcode

Description The EAN for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'algwceanproductmeta' shortcode in all versions up to, and including, 4.8.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

Wallet System for WooCommerce < 2.5.10 - Cross-Site Request Forgery

Description The Wallet System for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.9. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to perform a...

Inline Related Posts < 3.4.0 - Tracking Toggle via CSRF

Description The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on the managertrackingOn and managertrackingOff functions. This makes it possible for unauthenticated attackers to turn tracking on and off via a forged request granted they can trick a...

WP Matterport Shortcode < 2.2.0 - Cross-Site Request Forgery

Description The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an unknown action granted they can trick a site administrator into performing an action such as...

ELEX WooCommerce Dynamic Pricing and Discounts < 2.1.3 - Cross-Site Request Forgery

Description The ELEX WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1.2. This is due to missing or incorrect nonce validation on various function. This makes it possible for unauthenticated attackers t...

UsersWP < 1.2.6 - Cross-Site Request Forgery

Description The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.4. This is due to missing or incorrect nonce validation on an unknown...

Shortcodes and extra features for Phlox theme <= 2.15.2 - Subscriber+ PHP Object Injection

Description The plugin is vulnerable to PHP Object Injection via deserialization of untrusted input from the vulnerable 'id' parameter in the 'auxintemplatecontrolimporter' function. This makes it possible for authenticated attackers able to upload a separate PHAR payload as an image file to inje...

Marker.io < 1.1.9 - Cross-Site Request Forgery

Description The Marker.io plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.8. This is due to missing or incorrect nonce validation on the markeriosaveoption function. This makes it possible for unauthenticated attackers to update the plugin's...

Customer Reviews for WooCommerce < 5.47.0 - Missing Authorization to Authenticated (Subscriber+) Coupon Search

Description The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'woocommercejsonsearchcoupons' function . This makes it possible for attackers with subscriber level access to view coupon codes...

Extra Product Options Builder for WooCommerce < 1.2.105 - Cross-Site Request Forgery to Notice Dismissal

Description The Extra Product Options Builder for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.104. This is due to missing or incorrect nonce validation on the DontShowAgain function. This makes it possible for unauthenticated...

MailChimp Forms by MailMunch < 3.2.2 - Cross-Site Request Forgery

Description The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.1. This is due to missing or incorrect nonce validation on the integrate case. This makes it possible for unauthenticated attackers to update the...

e2pdf < 1.23.00 - Cross-Site Request Forgery

Description The e2pdf plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.20.27. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged...

MihanPanel < 12.7 - Cross-Site Request Forgery

Description The MihanPanel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to 12.7. This is due to missing or incorrect nonce validation on the delete and deleteall cases. This makes it possible for unauthenticated attackers to delete IP addresses from the blocked...

Sarada Lite < 1.1.3 - Cross-Site Request Forgery to Notice Dismissal

Description The Sarada Lite theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation on the saradaliteupdateadminnotice function. This makes it possible for unauthenticated attackers to dismiss...

Amelia < 1.0.96 - Cross-Site Request Forgery

Description The Amelia plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.95. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged...