Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
erabilities-part-3/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2473452%40wp-private-content-plus&new=2473452%40wp-private-content-plus&sfp_email=&sfph_mail=
CVE ID: CVE-2021-4386 State: PUBLISHED Published: 2023-07-01T03:30:14.115Z Last Updated: 2024-11-25T18:33:14.860Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: flippercode Products: WP Security Question Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP Security Question plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.5. This is due to missing or incorrect nonce validation on the save() function. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as c
e plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/23f9d758-4b5e-44e5-9f58-a37b01c4ffdb?source=cve - https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/ - https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/ - https://
abilities-part-3/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/ - https://plugins.trac.wordpress.org/browser/wp-security-questions/trunk/modules/settings/model.settings.php#L34
CVE ID: CVE-2021-4387 State: PUBLISHED Published: 2023-07-01T03:30:14.528Z Last Updated: 2024-10-25T14:09:43.788Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: wpopal Products: Opal Estate Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Opal Estate plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.11. This is due to missing or incorrect nonce validation on the opalestate_set_feature_property() and opalestate_remove_feature_property() functions. This makes it possible for unauthenticated attackers to set and remove featured properties via a forged request granted they can trick a
ssible for unauthenticated attackers to set and remove featured properties via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2645899c-2b6b-48bd-8f33-2a837a951c5e?source=cve - https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/ - https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/ - https://blog.nintechnet.com/multiple-wordpres
echnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/ - https://plugins.trac.wordpress.org/browser/opal-estate/trunk/inc/ajax-functions.php#L177
CVE ID: CVE-2021-4388 State: PUBLISHED Published: 2023-07-01T04:26:52.060Z Last Updated: 2024-10-25T16:01:20.484Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: wpopal Products: Opal Estate Problem Types: CWE-862 Missing Authorization Description: The Opal Estate plugin for WordPress is vulnerable to featured property modifications in versions up to, and including, 1.6.11. This is due to missing capability checks on the opalestate_set_feature_property() and opalestate_remove_feature_property() functions. This makes it possible for unauthenticated attackers to set and remove featured properties. Additional Analyst Notes: - CVE Program Container: - CISA ADP V
ticated attackers to set and remove featured properties. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5ce729a2-a106-45ab-b96c-cfe75246def7?source=cve - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/ - https://plugins.trac.wordpress.org/browser/opal-estate/trunk/inc/ajax-functions.php#L177
CVE ID: CVE-2021-4389 State: PUBLISHED Published: 2023-07-01T04:26:47.925Z Last Updated: 2024-10-28T13:06:03.292Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: wptravel Products: WP Travel – Best Travel Booking WordPress Plugin, Tour Management Engine Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP Travel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.4.6. This is due to missing or incorrect nonce validation on the save_meta_data() function. This makes it possible for unauthenticated attackers to save metadata for travel posts via a forged request granted they can trick a si
ossible for unauthenticated attackers to save metadata for travel posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/28dea1e9-e772-488e-b98f-93a46ab84581?source=cve - https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/ - https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/ - https://blog.nintechnet.com/multiple-wordpress-p
net.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/ - https://plugins.trac.wordpress.org/changeset/2477827/wp-travel/tags/4.4.7/inc/admin/class-admin-metaboxes.php
CVE ID: CVE-2021-4390 State: PUBLISHED Published: 2023-07-01T04:26:48.329Z Last Updated: 2024-10-28T13:06:27.043Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: ionuticlanzan Products: Contact Form 7 Style Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Contact Form 7 Style plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2. This is due to missing or incorrect nonce validation on the manage_wp_posts_be_qe_save_post() function. This makes it possible for unauthenticated attackers to quick edit templates via a forged request granted they can trick a site administrator into performin
icated attackers to quick edit templates via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2972cdaf-2d0a-4b55-b4f5-ccf01ff5352c?source=cve - https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/ - https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabiliti
ins-fixed-csrf-vulnerabilities-part-3/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/ - https://plugins.trac.wordpress.org/browser/contact-form-7-style/trunk/cf7-style-meta-box.php#L546
CVE ID: CVE-2021-4391 State: PUBLISHED Published: 2023-07-01T04:26:49.143Z Last Updated: 2024-10-25T14:08:25.217Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: wpswings Products: Ultimate Gift Cards for WooCommerce – Create, Redeem & Manage Digital Gift Certificates with Personalized Templates Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Ultimate Gift Cards for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1.1. This is due to missing or incorrect nonce validation on the mwb_wgm_save_post() function. This makes it possible for unauthenticated attackers to modify
ct nonce validation on the mwb_wgm_save_post() function. This makes it possible for unauthenticated attackers to modify product gift card details via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2da322ea-0206-4838-8ac4-9dd201bb00bc?source=cve - https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/ - https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-
ress-plugins-and-themes-vulnerable-to-csrf-attacks/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/ - https://plugins.trac.wordpress.org/browser/woo-gift-cards-lite/tags/2.1.2/admin/class-woocommerce-gift-cards-lite-admin.php?rev=2549904#L461
CVE ID: CVE-2021-4392 State: PUBLISHED Published: 2023-07-01T04:26:49.560Z Last Updated: 2024-10-25T14:08:51.799Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: implecode Products: eCommerce Product Catalog Plugin for WordPress Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.9.43. This is due to missing or incorrect nonce validation on the implecode_save_products_meta() function. This makes it possible for unauthenticated attackers to save product meta data via a forged request granted
) function. This makes it possible for unauthenticated attackers to save product meta data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2eb963dd-41c3-43cd-afb7-1be054829ea3?source=cve - https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/ - https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/ - https://blog.nintechnet.com/m
ttps://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2368356%40ecommerce-product-catalog&new=2368356%40ecommerce-product-catalog&sfp_email=&sfph_mail=
CVE ID: CVE-2021-4393 State: PUBLISHED Published: 2023-07-01T04:26:47.006Z Last Updated: 2024-10-25T14:08:05.131Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: implecode Products: eCommerce Product Catalog Plugin for WordPress Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.17. This is due to missing or incorrect nonce validation on the save() function. This makes it possible for unauthenticated attackers to save manual digital orders via a forged request granted they can trick a sit
t possible for unauthenticated attackers to save manual digital orders via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/12ecf3d5-1457-405a-8856-517c7d2f2db1?source=cve - https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/ - https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/ - https://blog.nintechnet.com/multiple-wordpress-pl
et.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/ - https://plugins.trac.wordpress.org/changeset/2473569/ecommerce-product-catalog/trunk/modules/cart/includes/orders/includes/register-digital-orders.php
CVE ID: CVE-2021-4394 State: PUBLISHED Published: 2023-07-01T04:26:50.813Z Last Updated: 2024-11-25T18:30:36.681Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: richardgabriel Products: Locations Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Locations plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.1. This is due to missing or incorrect nonce validation on the saveCustomFields() function. This makes it possible for unauthenticated attackers to update custom field meta data via a forged request granted they can trick a site administrator into performing an action such as clickin
eld meta data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3df9f237-a861-43fc-8623-d42f84d8d5d1?source=cve - https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/ - https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/ - https://blog.n
ies-part-3/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2548546%40locations&new=2548546%40locations&sfp_email=&sfph_mail=
CVE ID: CVE-2021-4395 State: PUBLISHED Published: 2023-07-01T05:33:24.356Z Last Updated: 2024-10-25T13:05:50.550Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: mrt3vn Products: Abandoned Cart Recovery for WooCommerce Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Abandoned Cart Recovery for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.4. This is due to missing or incorrect nonce validation on the get_items() and extra_tablenav() functions. This makes it possible for unauthenticated attackers to perform read-only actions via a forged request granted they can tri
s makes it possible for unauthenticated attackers to perform read-only actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/45b627f9-e7c6-4bf6-b1c7-d607f3e083f8?source=cve - https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/ - https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/ - https://blog.nintechnet.com/multiple-word
nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2550169%40woo-abandoned-cart-recovery&new=2550169%40woo-abandoned-cart-recovery&sfp_email=&sfph_mail=
CVE ID: CVE-2021-4396 State: PUBLISHED Published: 2023-07-01T05:33:25.307Z Last Updated: 2024-10-28T14:10:41.276Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: gips-nita Products: Rucy Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Rucy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.4.4. This is due to missing or incorrect nonce validation on the save_rc_post_meta() function. This makes it possible for unauthenticated attackers to save post meta via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Ana
request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/595d0401-55b9-418e-8b99-48b23e9a2662?source=cve - https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/ - https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/ - https://blog.nintechnet.com/multiple-word
nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/ - https://plugins.trac.wordpress.org/browser/rucy/trunk/inc/class-rucy-editor.php#L237
CVE ID: CVE-2021-4397 State: PUBLISHED Published: 2023-07-01T05:33:25.747Z Last Updated: 2024-10-28T14:10:19.887Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: richardgabriel Products: Staff Directory Plugin: Company Directory Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Staff Directory Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.6. This is due to missing or incorrect nonce validation on the saveCustomFields() function. This makes it possible for unauthenticated attackers to save custom fields via a forged request granted they can trick a site administrator into pe
unauthenticated attackers to save custom fields via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5971447d-0634-49a5-91d0-c4f0c0825a86?source=cve - https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/ - https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulner
ss-plugins-fixed-csrf-vulnerabilities-part-3/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/ - https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2548539%40staff-directory-pro&new=2548539%40staff-directory-pro&sfp_email=&sfph_mail=
CVE ID: CVE-2021-4398 State: PUBLISHED Published: 2023-07-01T05:33:26.180Z Last Updated: 2024-11-25T18:25:08.942Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: milmor Products: Amministrazione Trasparente Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Amministrazione Trasparente plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 7.1. This is due to missing or incorrect nonce validation on the at_save_aturl_meta() function. This makes it possible for unauthenticated attackers to update meta data via a forged request granted they can trick a site administrator into performing an action