Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 11,121

Export CSV
CVE-2022-1829

Inline Google Maps <= 5.11 - Arbitrary Settings Update to Stored XSS via CSRF

The Inline Google Maps WordPress plugin through 5.11 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Inline Google Maps Project
Products
Inline Google Maps
CVE-2022-1828

PDF24 Articles To PDF <= 4.2.2 - Arbitrary Settings Update via CSRF

The PDF24 Articles To PDF WordPress plugin through 4.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Pdf24 Articles To Pdf Project
Products
Pdf24 Articles To Pdf
CVE-2022-1827

PDF24 Article To PDF <= 4.2.2 - Arbitrary Settings Update via CSRF

The PDF24 Article To PDF WordPress plugin through 4.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Pdf24 Articles To Pdf Project
Products
Pdf24 Articles To Pdf
CVE-2022-1826

Cross-Linker <= 3.0.1.9 - Arbitrary Cross-Link Creation via CSRF

The Cross-Linker WordPress plugin through 3.0.1.9 does not have CSRF check in place when creating Cross-Links, which could allow attackers to make a logged in admin perform such action via a CSRF attack

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Cross-linker Project
Products
Cross-linker
CVE-2022-1818

Multi-page Toolkit <= 2.6 - Arbitrary Settings Update to Stored XSS via CSRF

The Multi-page Toolkit WordPress plugin through 2.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping as well

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Multi-page Toolkit Project
Products
Multi-page Toolkit
CVE-2022-1793

Private Files <= 0.40 - Protection Disabling via CSRF

The Private Files WordPress plugin through 0.40 is missing CSRF check when disabling the protection, which could allow attackers to make a logged in admin perform such action via a CSRF attack and make the blog public

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Private Files Project
Products
Private Files
CVE-2022-1792

Quick Subscribe <= 1.7.1 - Arbitrary Settings Update via CSRF to Stored XSS

The Quick Subscribe WordPress plugin through 1.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and leading to Stored XSS due to the lack of sanitisation and escaping in some of them

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Quick Subscribe Project
Products
Quick Subscribe
CVE-2022-1791

One Click Plugin Updater <= 2.4.14 - Arbitrary Settings Update via CSRF

The One Click Plugin Updater WordPress plugin through 2.4.14 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and disable / hide the badge of the available updates and the related check.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
One Click Plugin Updater Project
Products
One Click Plugin Updater
CVE-2022-1790

New User Email Set Up <= 0.5.2 - Arbitrary Settings Update via CSRF

The New User Email Set Up WordPress plugin through 0.5.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
New User Email Set Up Project
Products
New User Email Set Up
CVE-2022-1788

Change Uploaded File Permissions <= 4.0.0 - File Permission Update via CSRF

Due to missing checks the Change Uploaded File Permissions WordPress plugin through 4.0.0 is vulnerable to CSRF attacks. This can be used to change the file and folder permissions of any folder. This could be problematic when specific files like ini files are made readable for everyone due to this.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Change Uploaded File Permissions Project
Products
Change Uploaded File Permissions
CVE-2022-1787

Sideblog <= 6.0 - Arbitrary Settings Update via CSRF to Stored XSS

The Sideblog WordPress plugin through 6.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Sideblog Project
Products
Sideblog
CVE-2022-1781

postTabs <= 2.10.6 - Arbitrary Settings Update via CSRF to Stored XSS

The postTabs WordPress plugin through 2.10.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, which also lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Posttabs Project
Products
Posttabs
CVE-2022-1780

LaTeX for WordPress <= 3.4.10 - Arbitrary Settings Update via CSRF to Stored XSS

The LaTeX for WordPress plugin through 3.4.10 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack which could also lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Latex Project
Products
Latex
CVE-2022-1779

Auto Delete Posts <= 1.3.0 - Arbitrary Settings Update via CSRF

The Auto Delete Posts WordPress plugin through 1.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and delete specific posts, categories and attachments at once.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Auto Delete Posts Project
Products
Auto Delete Posts
CVE-2022-1765

Hot Linked Image Cacher <= 1.16 - Image upload/cache abuse via CSRF

The Hot Linked Image Cacher WordPress plugin through 1.16 is vulnerable to CSRF. This can be used to store / cache images from external domains on the server, which could lead to legal risks (due to copyright violations or licensing rules).

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Hot Linked Image Cacher Project
Products
Hot Linked Image Cacher
CVE-2022-1764

WP-chgFontSize <= 1.8 - Arbitrary Settings Update via CSRF to Stored XSS

The WP-chgFontSize WordPress plugin through 1.8 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wp-chgfontsize Project
Products
Wp-chgfontsize
CVE-2022-1763

Static Page eXtended <= 2.1 - Arbitrary Settings Update via CSRF to Stored XSS

Due to missing checks the Static Page eXtended WordPress plugin through 2.1 is vulnerable to CSRF attacks which allows changing the plugin settings, including required user levels for specific features. This could also lead to Stored Cross-Site Scripting due to the lack of escaping in some of the settings

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Static Page Extended Project
Products
Static Page Extended
CVE-2022-1761

Peter’s Collaboration E-mails <= 2.2.0 - Arbitrary Settings Update via CSRF

The Peter’s Collaboration E-mails WordPress plugin through 2.2.0 is vulnerable to CSRF due to missing nonce checks. This allows the change of its settings, which can be used to lower the required user level, change texts, the used email address and more.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Peter\'s Collaboration E-mails Project
Products
Peter\'s Collaboration E-mails
CVE-2022-1759

RB Internal Links <= 2.0.16 - Stored Cross-Site Scripting via CSRF

The RB Internal Links WordPress plugin through 2.0.16 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, as well as perform Stored Cross-Site Scripting attacks due to the lack of sanitisation and escaping

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Rb Internal Links Project
Products
Rb Internal Links
CVE-2022-1758

Genki Pre-Publish Reminder <= 1.4.1 - Stored XSS & RCE via CSRF

The Genki Pre-Publish Reminder WordPress plugin through 1.4.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored XSS as well as RCE when custom code is added via the plugin settings.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Genki Pre-publish Reminder Project
Products
Genki Pre-publish Reminder