14608 matches found
Paid Memberships Pro < 3.0.2 - Cross-Site Request Forgery
Description The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1. This is due to missing or incorrect nonce validation on the pmproupdatelevelgrouporder...
EleForms – All In One Form Integration including DB for Elementor < 2.9.9.8 - Unauthenticated Stored Cross-Site Scripting
Description The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 2.9.9.7 due to insufficient input sanitization and output escaping. This makes it possib...
Table & Contact Form 7 Database – Tablesome < 1.0.26 - Cross-Site Request Forgery
Description The Table & Contact Form 7 Database – Tablesome plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.25. This is due to missing or incorrect nonce validation on the publishtable function. This makes it possible for unauthenticated...
Dashboard To-Do List < 1.3.2 - Cross-Site Request Forgery via ardtdw_widgetupdate()
Description The Dashboard To-Do List plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.1. This is due to missing or incorrect nonce validation on the ardtdwwidgetupdatefunction. This makes it possible for unauthenticated attackers to update...
Product Input Fields for WooCommerce < 1.8.0 - Cross-Site Request Forgery to Notice Dismissal
Description The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.0. This is due to missing or incorrect nonce validation on the dismissnotice function. This makes it possible for unauthenticated attackers t...
F4 Improvements < 1.8.1 - Authenticated (Admin+) Stored Cross-Site Scripting
Description The F4 Improvements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...
Popup by Supsystic < 1.10.28 - Missing Authorization
Description The Popup by Supsystic plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.10.27. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an...
Page Builder: Live Composer < 1.5.36 - Cross-Site Request Forgery
Description The Page Builder: Live Composer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.35. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to perform...
Customer Reviews for WooCommerce < 5.47.0 - Missing Authorization to Authenticated (Subscriber+) Coupon Search
Description The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'woocommercejsonsearchcoupons' function . This makes it possible for attackers with subscriber level access to view coupon codes...
AppPresser < 4.3.1 - Cross-Site Request Forgery via force_logging_off()
Description The AppPresser plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.3.0. This is due to missing or incorrect nonce validation on the forceloggingoff function. This makes it possible for unauthenticated attackers to turn logging off via a...
Benchmark Email Lite < 4.2 - Cross-Site Request Forgery via page_settings()
Description The Benchmark Email Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.1. This is due to missing or incorrect nonce validation on the pagesettings function. This makes it possible for unauthenticated attackers to update the plugin...
Currency per Product for WooCommerce < 1.7.0 - Cross-Site Request Forgery to Notice Dismissal
Description The Currency per Product for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.0. This is due to missing or incorrect nonce validation on the dismissnotice function. This makes it possible for unauthenticated attackers t...
Content Control < 2.2.0 - Missing Authorization to Sensitive Information Exposure
Description The Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.0 via the API. This makes it possible for unauthenticated...
WP Meta SEO < 4.5.13 - Unauthenticated Stored Cross-Site Scripting via Referer header
Description The WP Meta SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Referer’ header in all versions up to, and including, 4.5.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...
MailChimp Forms by MailMunch < 3.2.2 - Cross-Site Request Forgery
Description The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.1. This is due to missing or incorrect nonce validation on the integrate case. This makes it possible for unauthenticated attackers to update the...
Spotlight Social Media Feeds < 1.6.11 - Cross-Site Request Forgery
Description The Spotlight Social Media Feeds plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.10. This is due to missing or incorrect nonce validation in the AuthCallbackListener class. This makes it possible for unauthenticated attackers to...
TWIPLA (Visitor Analytics IO) < 1.3.0 - Authenticated (Admin+) Stored Cross-Site Scripting
Description The TWIPLA Visitor Analytics IO – Privacy-First Website Stats, Session Recordings, Heatmaps, Polls and Surveys plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.0 due to insufficient input sanitization and...
Ultimate Product Catalogue < 5.2.16 - Cross-Site Request Forgery via reset_settings()
Description The Ultimate Product Catalogue plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.2.15. This is due to missing or incorrect nonce validation on the resetsettings function. This makes it possible for unauthenticated attackers to reset t...
WP Matterport Shortcode < 2.2.0 - Cross-Site Request Forgery
Description The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an unknown action granted they can trick a site administrator into performing an action such as...
Sarada Lite < 1.1.3 - Cross-Site Request Forgery to Notice Dismissal
Description The Sarada Lite theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to missing or incorrect nonce validation on the saradaliteupdateadminnotice function. This makes it possible for unauthenticated attackers to dismiss...
Restrict Content < 3.2.9 - Missing Authorization
Description The Restrict Content plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the updateoptingetstatus function in versions up to, and including, 3.2.8. This makes it possible for unauthenticated attackers to update opt in status...
WP Login and Logout Redirect < 2.0 - Authenticated (Admin+) Stored Cross-Site Scripting
Description The WP Login and Logout Redirect plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
USPS Shipping for WooCommerce – Live Rates < 1.9.3 - Cross-Site Request Forgery
Description The USPS Shipping for WooCommerce – Live Rates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.2. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attacker...
EleForms – All In One Form Integration including DB for Elementor < 2.9.9.8 - Missing Authorization to Sensitive Information Exposure
Description The EleForms – All In One Form Integration including DB for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check when downloading form submissions in all versions up to, and including, 2.9.9.7. This makes it possible for...
WooCommerce UPS Shipping – Live Rates and Access Points < 2.2.5 - Cross-Site Request Forgery
Description The WooCommerce UPS Shipping – Live Rates and Access Points plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.4. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for...
Search Keyword Redirect <= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting
Description The Search Keyword Redirect plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
Advanced Cron Manager – debug & control < 2.5.3 - Authenticated (Admin+) Stored Cross-Site Scripting
Description The Advanced Cron Manager – debug & control plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...
Login with phone number < 1.6.94 - Cross-Site Request Forgery
Description The Login with phone number plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.93. This is due to missing or incorrect nonce validation on the lwpforgotpassword and lwpupdatepasswordaction functions. This makes it possible for...
UsersWP < 1.2.6 - Cross-Site Request Forgery
Description The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.4. This is due to missing or incorrect nonce validation on an unknown...
No-Bot Registration < 2.0 - Cross-Site Request Forgery
Description The No-Bot Registration plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.9.1. This is due to missing or incorrect nonce validation on the ajdgnobotdashboard function. This makes it possible for unauthenticated attackers to moderate v...
Shortcodes and extra features for Phlox theme <= 2.15.2 - Subscriber+ PHP Object Injection
Description The plugin is vulnerable to PHP Object Injection via deserialization of untrusted input from the vulnerable 'id' parameter in the 'auxintemplatecontrolimporter' function. This makes it possible for authenticated attackers able to upload a separate PHAR payload as an image file to inje...
Save as Image < 3.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting
Description The Save as Image Plugin by Pdfcrowd plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
Feather Login Page < 1.1.6 - Cross-Site Request Forgery via saveData()
Description The Feather Login Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.5. This is due to missing or incorrect nonce validation on the saveData function. This makes it possible for unauthenticated attackers to update the plugin's...
Top Bar < 3.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting
Description The Top Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...
WooCommerce Google Feed Manager < 2.6.0 - Authenticated (Admin+) SQL Injection to Reflected Cross-Site Scripting
Description The WooCommerce Google Feed Manager plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 2.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This mak...
WordPress Hosting Benchmark tool < 1.3.7 - Cross-Site Request Forgery via execute_plugin()
Description The WordPress Hosting Benchmark tool plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.6. This is due to missing or incorrect nonce validation on the executeplugin function. This makes it possible for unauthenticated attackers to...
Amelia < 1.0.96 - Cross-Site Request Forgery
Description The Amelia plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.95. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged...
Marker.io < 1.1.9 - Cross-Site Request Forgery
Description The Marker.io plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.8. This is due to missing or incorrect nonce validation on the markeriosaveoption function. This makes it possible for unauthenticated attackers to update the plugin's...
Simple Post Notes < 1.7.7 - Cross-Site Request Forgery
Description The Simple Post Notes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to 1.7.7 exclusive. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to perform an unknown action...
5 star review funnel for Google Reviews, Trustpilot, ProvenExpert and more | RRatingg < 1.3.02 - Missing Authorization
Description The 5 star review funnel for Google Reviews, Trustpilot, ProvenExpert and more | RRatingg plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in all versions up to, and including, 1.2.67. This makes it possible for...
Customer Reviews for WooCommerce < 5.47.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending
Description The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the sendtestemail function in all versions up to, and including, 5.46.0. This makes it possible for authenticated attackers, with subscriber-level...
e2pdf < 1.23.00 - Cross-Site Request Forgery
Description The e2pdf plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.20.27. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged...
ReDi Restaurant Reservation < 24.0303 - Cross-Site Request Forgery via redi_restaurant_admin_options_page()
Description The ReDi Restaurant Reservation plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 24.0128. This is due to missing or incorrect nonce validation on the redirestaurantadminoptionspage function. This makes it possible for unauthenticated...
Popup Like box – Page < 3.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
Description The Popup Like box – Page Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.7.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
WP Event Aggregator < 1.7.7 - Cross-Site Request Forgery via wpea_deauthorize_user()
Description The WP Event Aggregator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.6. This is due to missing or incorrect nonce validation on the wpeadeauthorizeuser function. This makes it possible for unauthenticated attackers to remove a...
Blocksy Companion < 2.0.29 - Cross-Site Request Forgery
Description The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to perform unauthorized actions via a forged request granted they can trick a site administrator into performi...
Login With Ajax < 4.2 - Cross-Site Request Forgery to Notice Dismissal
Description The Login With Ajax plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.1. This is due to missing or incorrect nonce validation on the dismissadminnotice function. This makes it possible for unauthenticated attackers to dismiss notices...
Calendarista Basic Edition < 3.0.3 - Cross-Site Request Forgery
Description The Calendarista Basic Edition plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.2. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to perform...
Extra Product Options Builder for WooCommerce < 1.2.105 - Cross-Site Request Forgery to Notice Dismissal
Description The Extra Product Options Builder for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.104. This is due to missing or incorrect nonce validation on the DontShowAgain function. This makes it possible for unauthenticated...
WP Accessibility Helper (WAH) < 0.6.2.6 - Missing Authorization
Description The WP Accessibility Helper WAH plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the updateattachmentalt function in versions up to, and including, 0.6.2.5. This makes it possible for authenticated attackers, with...