Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2023-3977

Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function

Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for unauthenticated attackers to install plugins from the limited list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Backupbliss Copy-delete-posts Inisev and 2 more
Products
Backup Migration Clone Duplicate Post and 7 more
CVE-2023-0958

Inisev Plugins (Various Versions) - Missing Authorization on handle_installation function

Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for authenticated attackers with minimal permissions, such as subscribers, to install select plugins from Inisev on vulnerable sites. CVE-2023-38514 appears to be a duplicate of this vulnerability.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Backupbliss Copy-delete-posts Inisev and 3 more
Products
Backup Migration Clone Duplicate Post and 8 more
CVE-2023-1330

Redirection < 1.1.4 - Redirect Creation via CSRF

The Redirection WordPress plugin before 1.1.4 does not add nonce verification in place when adding the redirect, which could allow attackers to add redirects via a CSRF attack.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Inisev
Products
Redirection
CVE-2023-1331

Redirection < 1.1.5 - Plugin Reset via CSRF

The Redirection WordPress plugin before 1.1.5 does not have CSRF checks in the uninstall action, which could allow attackers to make logged in admins delete all the redirections through a CSRF attack.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Inisev
Products
Redirection