VYPR
← WordPress

Vendor CVEs

WordPress

All CVEs

36,928 total · sorted by risk
  • CVE-2023-5602MedOct 20, 2023
    WordPress
    Social Media Share Buttons & Social Sharing Icons
    risk 0.21cvss 4.3epss 0.00

    The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.5. This is due to missing or incorrect nonce validation on several functions corresponding to AJAX actions. This makes…

  • CVE-2023-4941MedOct 20, 2023
    WordPress
    BEAR for WordPress
    risk 0.21cvss 4.3epss 0.00

    The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe_bulkoperations_swap function. This makes it possible for authenticated attackers (subscriber or higher) to manipulate…

  • CVE-2023-4796MedOct 20, 2023
    Booster
    Booster For Woocommerce
    risk 0.21cvss 4.3epss 0.01

    The Booster for WooCommerce for WordPress is vulnerable to Information Disclosure via the 'wcj_wp_option' shortcode in versions up to, and including, 7.1.0 due to insufficient controls on the information retrievable via the shortcode. This makes it possible for authenticated…

  • CVE-2020-36758MedOct 20, 2023
    WordPress
    RSS Aggregator by Feedzy
    risk 0.21cvss 4.3epss 0.00

    The RSS Aggregator by Feedzy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.2. This is due to missing or incorrect nonce validation on the save_feedzy_post_type_meta() function. This makes it possible for unauthenticated…

  • CVE-2020-36751MedOct 20, 2023
    WordPress
    Coupon Creator
    risk 0.21cvss 4.3epss 0.00

    The Coupon Creator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1. This is due to missing or incorrect nonce validation on the save_meta() function. This makes it possible for unauthenticated attackers to save meta fields…

  • CVE-2023-4975MedOct 20, 2023
    Seedprod
    Website Builder By Seedprod
    risk 0.21cvss 4.3epss 0.00

    The Website Builder by SeedProd plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.15.13.1. This is due to missing or incorrect nonce validation on functionality in the builder.php file. This makes it possible for unauthenticated…

  • CVE-2023-4943MedOct 20, 2023
    WordPress
    BEAR for WordPress
    risk 0.21cvss 4.3epss 0.00

    The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe_bulkoperations_visibility function. This makes it possible for authenticated attackers (subscriber or higher) to…

  • CVE-2023-4942MedOct 20, 2023
    WordPress
    BEAR for WordPress
    risk 0.21cvss 4.3epss 0.00

    The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulkoperations_visibility function. This makes it possible for unauthenticated attackers to manipulate…

  • CVE-2023-4940MedOct 20, 2023
    WordPress
    BEAR
    risk 0.21cvss 4.3epss 0.00

    The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulkoperations_swap function. This makes it possible for unauthenticated attackers to manipulate…

  • CVE-2023-4937MedOct 20, 2023
    WordPress
    BEAR
    risk 0.21cvss 4.3epss 0.00

    The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_bulkoperations_apply_default_combination function. This makes it possible for unauthenticated attackers…

  • CVE-2023-4935MedOct 20, 2023
    WordPress
    BEAR
    risk 0.21cvss 4.3epss 0.00

    The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the create_profile function. This makes it possible for unauthenticated attackers to create profiles via a forged…

  • CVE-2023-4920MedOct 20, 2023
    WordPress
    BEAR for WordPress
    risk 0.21cvss 4.3epss 0.00

    The BEAR for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.3.3. This is due to missing or incorrect nonce validation on the woobe_save_options function. This makes it possible for unauthenticated attackers to modify the plugin's…

  • CVE-2023-4938MedOct 18, 2023
    WordPress
    BEAR
    risk 0.21cvss 4.3epss 0.00

    The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe_bulkoperations_apply_default_combination function. This makes it possible for authenticated attackers (subscriber or…

  • CVE-2012-10016MedOct 17, 2023
    WordPress
    simple-download-button-shortcode
    risk 0.21cvss 4.3epss 0.01

    A vulnerability classified as problematic has been found in Halulu simple-download-button-shortcode Plugin 1.0 on WordPress. Affected is an unknown function of the file simple-download-button_dl.php of the component Download Handler. The manipulation of the argument file leads…

  • CVE-2023-39999MedOct 13, 2023
    WordPress
    WordPress
    risk 0.21cvss 4.3epss 0.01

    Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through 6.0.5, from 5.9 through 5.9.7, from 5.8 through 5.8.7, from 5.7 through 5.7.9, from 5.6 through 5.6.11, from 5.5…

  • CVE-2015-10125MedOct 5, 2023
    WordPress
    WP Ultimate CSV Importer Plugin
    risk 0.21cvss 4.3epss 0.00

    A vulnerability classified as problematic has been found in WP Ultimate CSV Importer Plugin 3.7.2 on WordPress. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 3.7.3 is able…

  • CVE-2023-3764MedAug 31, 2023
    WordPress
    WooCommerce PDF Invoice Builder
    risk 0.21cvss 4.3epss 0.00

    The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.90. This is due to missing or incorrect nonce validation on the Save function. This makes it possible for unauthenticated attackers to make…

  • CVE-2023-2353MedAug 31, 2023
    WordPress
    Chp Ads Block Detector
    risk 0.21cvss 4.3epss 0.01

    The CHP Ads Block Detector plugin for WordPress is vulnerable to unauthorized plugin settings update and reset due to a missing capability check on the chp_abd_action function in versions up to, and including, 3.9.4. This makes it possible for subscriber-level attackers to…

  • CVE-2023-2352MedAug 31, 2023
    WordPress
    Chp Ads Block Detector
    risk 0.21cvss 4.3epss 0.00

    The CHP Ads Block Detector plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.9.4. This is due to missing or incorrect nonce validation on the chp_abd_action function. This makes it possible for unauthenticated attackers to…

  • CVE-2023-3244MedAug 17, 2023
    WordPress
    Comments Like Dislike
    risk 0.21cvss 4.3epss 0.01

    The Comments Like Dislike plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the restore_settings function called via an AJAX action in versions up to, and including, 1.2.0. This makes it possible for authenticated…

  • CVE-2023-4374MedAug 16, 2023
    WordPress
    WP Remote Users Sync
    risk 0.21cvss 4.3epss 0.01

    The WP Remote Users Sync plugin for WordPress is vulnerable to unauthorized access of data and addition of data due to a missing capability check on the 'refresh_logs_async' functions in versions up to, and including, 1.2.11. This makes it possible for authenticated attackers…

  • CVE-2023-3977MedJul 28, 2023
    Inisev
    Enhanced Text Widget
    risk 0.21cvss 4.3epss 0.01

    Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it…

  • CVE-2023-0958MedJul 28, 2023
    Inisev
    Enhanced Text Widget
    risk 0.21cvss 4.3epss 0.01

    Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for…

  • CVE-2023-3957MedJul 27, 2023
    WordPress
    Acf Photo Gallery Field
    risk 0.21cvss 4.3epss 0.01

    The ACF Photo Gallery Field plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient restriction on the 'apg_profile_update' function in versions up to, and including, 1.9. This makes it possible for authenticated attackers, with…

  • CVE-2021-4424MedJul 12, 2023
    WordPress
    Slider Hero
    risk 0.21cvss 4.3epss 0.00

    The Slider Hero plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.2.0. This is due to missing or incorrect nonce validation on the qc_slider_hero_duplicate() function. This makes it possible for unauthenticated attackers to…

  • CVE-2021-4423MedJul 12, 2023
    WordPress
    Rays Grid
    risk 0.21cvss 4.3epss 0.00

    The RAYS Grid plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.2. This is due to missing or incorrect nonce validation on the rsgd_insert_update() function. This makes it possible for unauthenticated attackers to update post…

  • CVE-2023-2869MedJul 12, 2023
    WordPress
    WP-Members Membership
    risk 0.21cvss 4.3epss 0.01

    The WP-Members Membership plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the do_field_reorder function in versions up to, and including, 3.4.7.3. This makes it possible for authenticated attackers with…

  • CVE-2021-4416MedJul 12, 2023
    WordPress
    Wp Mpdf
    risk 0.21cvss 4.3epss 0.00

    The wp-mpdf plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.1. This is due to missing or incorrect nonce validation on the mpdf_admin_savepost() function. This makes it possible for unauthenticated attackers to save post…

  • CVE-2021-4415MedJul 12, 2023
    WordPress
    Sunshine Photo Cart
    risk 0.21cvss 4.3epss 0.00

    The Sunshine Photo Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.28 This is due to missing or incorrect nonce validation on the sunshine_products_quicksave_post() function. This makes it possible for unauthenticated…

  • CVE-2021-4414MedJul 12, 2023
    WordPress
    Abandoned Cart Lite For Woocommerce
    risk 0.21cvss 4.3epss 0.00

    The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.8.5. This is due to missing or incorrect nonce validation on the wcal_preview_emails() function. This makes it possible for…

  • CVE-2020-36750MedJul 12, 2023
    Ewww
    Image Optimizer
    risk 0.21cvss 4.3epss 0.00

    The EWWW Image Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.8.1. This is due to missing or incorrect nonce validation on the ewww_ngg_bulk_init() function. This makes it possible for unauthenticated attackers to…

  • CVE-2021-4405MedJul 1, 2023
    WordPress
    Elasticpress
    risk 0.21cvss 4.3epss 0.00

    The ElasticPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.3. This is due to missing or incorrect nonce validation on the epio_send_autosuggest_allowed() function. This makes it possible for unauthenticated attackers…

  • CVE-2021-4404MedJul 1, 2023
    WordPress
    Event Espresso 4 Decaf
    risk 0.21cvss 4.3epss 0.00

    The Event Espresso 4 Decaf plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.10.11. This is due to missing or incorrect nonce validation on the ajaxHandler() function. This makes it possible for unauthenticated attackers to op…

  • CVE-2020-36748MedJul 1, 2023
    Dokan
    Dokan
    risk 0.21cvss 4.3epss 0.00

    The Dokan plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.8. This is due to missing or incorrect nonce validation on the handle_order_export() function. This makes it possible for unauthenticated attackers to trigger an…

  • CVE-2021-4393MedJul 1, 2023
    WordPress
    eCommerce Product Catalog Plugin
    risk 0.21cvss 4.3epss 0.00

    The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.17. This is due to missing or incorrect nonce validation on the save() function. This makes it possible for unauthenticated…

  • CVE-2021-4389MedJul 1, 2023
    WordPress
    Wp Travel
    risk 0.21cvss 4.3epss 0.00

    The WP Travel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.4.6. This is due to missing or incorrect nonce validation on the save_meta_data() function. This makes it possible for unauthenticated attackers to save metadata…

  • CVE-2020-36744MedJul 1, 2023
    WordPress
    Notificationx
    risk 0.21cvss 4.3epss 0.00

    The NotificationX plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.2. This is due to missing or incorrect nonce validation on the generate_conversions() function. This makes it possible for unauthenticated attackers to…

  • CVE-2020-36743MedJul 1, 2023
    Implecode
    Product Catalog Simple
    risk 0.21cvss 4.3epss 0.00

    The Product Catalog Simple plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.13. This is due to missing or incorrect nonce validation on the implecode_save_products_meta() function. This makes it possible for unauthenticated…

  • CVE-2020-36738MedJul 1, 2023
    WordPress
    Cool Timeline
    risk 0.21cvss 4.3epss 0.00

    The Cool Timeline (Horizontal & Vertical Timeline) plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the ctl_save() function. This makes it possible for…

  • CVE-2020-36736MedJul 1, 2023
    WordPress
    WooCommerce Checkout & Funnel Builder by CartFlows
    risk 0.21cvss 4.3epss 0.00

    The WooCommerce Checkout & Funnel Builder by CartFlows plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.15. This is due to missing or incorrect nonce validation on the export_json, import_json, and status_logs_file functions.…

  • CVE-2023-2896MedJun 9, 2023
    WordPress
    Wp Easycart
    risk 0.21cvss 4.3epss 0.00

    The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to missing or incorrect nonce validation on the process_duplicate_product function. This makes it possible for unauthenticated attackers to…

  • CVE-2023-2895MedJun 9, 2023
    WordPress
    Wp Easycart
    risk 0.21cvss 4.3epss 0.00

    The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to missing or incorrect nonce validation on the process_bulk_activate_product function. This makes it possible for unauthenticated attackers to…

  • CVE-2023-2894MedJun 9, 2023
    WordPress
    Wp Easycart
    risk 0.21cvss 4.3epss 0.00

    The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to missing or incorrect nonce validation on the process_bulk_deactivate_product function. This makes it possible for unauthenticated attackers to…

  • CVE-2023-2893MedJun 9, 2023
    WordPress
    Wp Easycart
    risk 0.21cvss 4.3epss 0.00

    The WP EasyCart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.4.8. This is due to missing or incorrect nonce validation on the process_deactivate_product function. This makes it possible for unauthenticated attackers to…

  • CVE-2023-2557MedJun 9, 2023
    WordPress
    WPCS – WordPress Currency Switcher Professional
    risk 0.21cvss 4.3epss 0.00

    The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save function in versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with…

  • CVE-2023-2556MedJun 9, 2023
    WordPress
    WPCS – WordPress Currency Switcher Professional
    risk 0.21cvss 4.3epss 0.00

    The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the anonymous function for the wpcs_sd_delete action in versions up to, and including, 1.1.9. This makes it possible…

  • CVE-2023-2555MedJun 9, 2023
    WordPress
    WPCS – WordPress Currency Switcher Professional
    risk 0.21cvss 4.3epss 0.00

    The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create function in versions up to, and including, 1.1.9. This makes it possible for authenticated attackers,…

  • CVE-2023-2189MedJun 9, 2023
    Staxwp
    Stax
    risk 0.21cvss 4.3epss 0.01

    The Elementor Addons, Widgets and Enhancements – Stax plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the toggle_widget function in versions up to, and including, 1.4.3. This makes it possible for authenticated…

  • CVE-2023-1807MedJun 9, 2023
    WordPress
    Elementor Addons, Widgets and Enhancements – Stax
    risk 0.21cvss 4.3epss 0.00

    The Elementor Addons, Widgets and Enhancements – Stax plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.3. This is due to missing or incorrect nonce validation on the toggle_widget function. This makes it possible for…

  • CVE-2023-1169MedJun 9, 2023
    WordPress
    Ooohboi Steroids For Elementor
    risk 0.21cvss 4.3epss 0.01

    The OoohBoi Steroids for Elementor plugin for WordPress is vulnerable to missing authorization due to a missing capability check on the 'file_uploader_callback' function in versions up to, and including, 2.1.4. This makes it possible for subscriber-level attackers to upload…

Page 687 of 739