Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10,004

Export CSV
CVE-2022-1764

WP-chgFontSize <= 1.8 - Arbitrary Settings Update via CSRF to Stored XSS

The WP-chgFontSize WordPress plugin through 1.8 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wp-chgfontsize Project
Products
Wp-chgfontsize
CVE-2022-1763

Static Page eXtended <= 2.1 - Arbitrary Settings Update via CSRF to Stored XSS

Due to missing checks the Static Page eXtended WordPress plugin through 2.1 is vulnerable to CSRF attacks which allows changing the plugin settings, including required user levels for specific features. This could also lead to Stored Cross-Site Scripting due to the lack of escaping in some of the settings

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Static Page Extended Project
Products
Static Page Extended
CVE-2022-1761

Peter’s Collaboration E-mails <= 2.2.0 - Arbitrary Settings Update via CSRF

The Peter’s Collaboration E-mails WordPress plugin through 2.2.0 is vulnerable to CSRF due to missing nonce checks. This allows the change of its settings, which can be used to lower the required user level, change texts, the used email address and more.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Peter\'s Collaboration E-mails Project
Products
Peter\'s Collaboration E-mails
CVE-2022-1759

RB Internal Links <= 2.0.16 - Stored Cross-Site Scripting via CSRF

The RB Internal Links WordPress plugin through 2.0.16 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, as well as perform Stored Cross-Site Scripting attacks due to the lack of sanitisation and escaping

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Rb Internal Links Project
Products
Rb Internal Links
CVE-2022-1758

Genki Pre-Publish Reminder <= 1.4.1 - Stored XSS & RCE via CSRF

The Genki Pre-Publish Reminder WordPress plugin through 1.4.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored XSS as well as RCE when custom code is added via the plugin settings.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Genki Pre-publish Reminder Project
Products
Genki Pre-publish Reminder
CVE-2022-1757

Pagebar < 2.70 - Arbitrary Settings Update via CSRF to Stored XSS

The pagebar WordPress plugin before 2.70 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. Furthermore, due to the lack of sanitisation in some of them, it could also lead to Stored XSS issues

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Pagebar Project
Products
Pagebar
CVE-2022-1732

Rename wp-login.php <= 2.6.0 - Secret URL Update via CSRF

The Rename wp-login.php WordPress plugin through 2.6.0 does not have CSRF check in place when updating the secret login URL, which could allow attackers to make a logged in admin change them via a CSRF attack

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Rename Wp-login Project
Products
Rename Wp-login
CVE-2022-1712

LiveSync for WordPress <= 1.0 - Arbitrary Settings Update via CSRF

The LiveSync for WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Livesync Project
Products
Livesync
CVE-2022-1709

Throws SPAM Away < 3.3.1 - Comment Deletion via CSRF

The Throws SPAM Away WordPress plugin before 3.3.1 does not have CSRF checks in place when deleting comments (either all, spam, or pending), allowing attackers to make a logged in admin delete comments via a CSRF attack

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gti
Products
Throws Spam Away
CVE-2022-1695

WP Simple Adsense Insertion < 2.1 - Inject ads and javascript via CSRF

The WP Simple Adsense Insertion WordPress plugin before 2.1 does not perform CSRF checks on updates to its admin page, allowing an attacker to trick a logged in user to manipulate ads and inject arbitrary javascript via submitting a form.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Tipsandtricks-hq
Products
Wp Simple Adsense Insertion
CVE-2022-1694

Useful Banner Manager <= 1.6.1 - Modify banners via CSRF

The Useful Banner Manager WordPress plugin through 1.6.1 does not perform CSRF checks on POST requests to its admin page, allowing an attacker to trick a logged in admin to add, modify or delete banners from the plugin by submitting a form.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Useful Banner Manager Project
Products
Useful Banner Manager
CVE-2022-1672

Insights from Google PageSpeed < 4.0.7 - Multiple CSRF

The Insights from Google PageSpeed WordPress plugin before 4.0.7 does not verify for CSRF before doing various actions such as deleting Custom URLs, which could allow attackers to make a logged in admin perform such actions via CSRF attacks

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Insights From Google Pagespeed Project
Products
Insights From Google Pagespeed
CVE-2022-1653

Social Share Buttons by Supsystic < 2.2.4 - Multiple CSRF

The Social Share Buttons by Supsystic WordPress plugin before 2.2.4 does not perform CSRF checks in it's ajax endpoints and admin pages, allowing an attacker to trick any logged in user to manipulate or change the plugin settings, as well as create, delete and rename projects and networks.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Supsystic
Products
Social Share Buttons
CVE-2022-1630

WP-Email < 2.69.0 - Log Deletion via CSRF

The WP-EMail WordPress plugin before 2.69.0 does not protect its log deletion functionality with nonce checks, allowing attacker to make a logged in admin delete logs via a CSRF attack

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wp-email Project
Products
Wp-email
CVE-2022-1627

My Private Site < 3.0.8 - Arbitrary Settings Update via CSRF

The My Private Site WordPress plugin before 3.0.8 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Zatzlabs
Products
My Private Site
CVE-2022-1626

Sharebar <= 1.4.1 - Arbitrary Settings Update to Stored XSS via CSRF

The Sharebar WordPress plugin through 1.4.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and also lead to Stored Cross-Site Scripting issue due to the lack of sanitisation and escaping in some of them

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Sharebar Project
Products
Sharebar
CVE-2022-1625

New User Approve < 2.4 - Arbitrary Settings Update & Invitation Code Creation via CSRF

The New User Approve WordPress plugin before 2.4 does not have CSRF check in place when updating its settings and adding invitation codes, which could allow attackers to add invitation codes (for bypassing the provided restrictions) and to change plugin settings by tricking admin users into visiting specially crafted websites.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wpexperts
Products
New User Approve
CVE-2022-1624

Latest Tweets Widget <= 1.1.4 - Arbitrary Settings Update via CSRF

The Latest Tweets Widget WordPress plugin through 1.1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Latest Tweets Widget Project
Products
Latest Tweets Widget
CVE-2022-1618

Coru LFMember <= 1.0.2 - Stored Cross-Site Scripting via CSRF

The Coru LFMember WordPress plugin through 1.0.2 does not have CSRF check in place when adding a new game, and is lacking sanitisation as well as escaping in their settings, allowing attacker to make a logged in admin add an arbitrary game with XSS payloads

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Marcorulicke
Products
Coru Lfmember
CVE-2022-1612

Webriti SMTP Mail <= 1.0 - Arbitrary Settings Update via CSRF

The Webriti SMTP Mail WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Webriti
Products
Webriti Smtp Mail