Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (8633 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-1913 1 Add Post Url Project 1 Add Post Url 2024-11-21 4.3 Medium
The Add Post URL WordPress plugin through 2.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
CVE-2022-1895 1 Underconstruction Project 1 Underconstruction 2024-11-21 4.3 Medium
The underConstruction WordPress plugin before 1.20 does not have CSRF check in place when deactivating the construction mode, which could allow attackers to make a logged in admin perform such action via a CSRF attack
CVE-2022-1885 1 Cimy Header Image Rotator Project 1 Cimy Header Image Rotator 2024-11-21 4.3 Medium
The Cimy Header Image Rotator WordPress plugin through 6.1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVE-2022-1847 1 Rotating Posts Project 1 Rotating Posts 2024-11-21 4.3 Medium
The Rotating Posts WordPress plugin through 1.11 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVE-2022-1846 1 Tiny Contact Form Project 1 Tiny Contact Form 2024-11-21 4.3 Medium
The Tiny Contact Form WordPress plugin through 0.7 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVE-2022-1845 1 Wp Post Styling Project 1 Wp Post Styling 2024-11-21 4.3 Medium
The WP Post Styling WordPress plugin before 1.3.1 does not have CSRF checks in various actions, which could allow attackers to make a logged in admin delete plugin's data, update the settings, add new entries and more via CSRF attacks
CVE-2022-1844 1 Wp-sentry Project 1 Wp-sentry 2024-11-21 4.3 Medium
The WP Sentry WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping as well
CVE-2022-1843 1 Mailpress Project 1 Mailpress 2024-11-21 6.5 Medium
The MailPress WordPress plugin through 7.2.1 does not have CSRF checks in various places, which could allow attackers to make a logged in admin change the settings, purge log files and more via CSRF attacks
CVE-2022-1842 1 Openbook Book Data Project 1 Openbook Book Data 2024-11-21 4.3 Medium
The OpenBook Book Data WordPress plugin through 3.5.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping as well
CVE-2022-1832 1 Capa Protect Project 1 Capa Protect 2024-11-21 6.5 Medium
The CaPa Protect WordPress plugin through 0.5.8.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and disable the applied protection.
CVE-2022-1831 1 Wplite Project 1 Wplite 2024-11-21 6.5 Medium
The WPlite WordPress plugin through 1.3.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVE-2022-1830 1 Amazon Einzeltitellinks Project 1 Amazon Einzeltitellinks 2024-11-21 6.5 Medium
The Amazon Einzeltitellinks WordPress plugin through 1.3.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
CVE-2022-1829 1 Inline Google Maps Project 1 Inline Google Maps 2024-11-21 6.5 Medium
The Inline Google Maps WordPress plugin through 5.11 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
CVE-2022-1828 1 Pdf24 Articles To Pdf Project 1 Pdf24 Articles To Pdf 2024-11-21 6.5 Medium
The PDF24 Articles To PDF WordPress plugin through 4.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVE-2022-1827 1 Pdf24 Articles To Pdf Project 1 Pdf24 Articles To Pdf 2024-11-21 6.5 Medium
The PDF24 Article To PDF WordPress plugin through 4.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVE-2022-1826 1 Cross-linker Project 1 Cross-linker 2024-11-21 6.5 Medium
The Cross-Linker WordPress plugin through 3.0.1.9 does not have CSRF check in place when creating Cross-Links, which could allow attackers to make a logged in admin perform such action via a CSRF attack
CVE-2022-1818 1 Multi-page Toolkit Project 1 Multi-page Toolkit 2024-11-21 5.4 Medium
The Multi-page Toolkit WordPress plugin through 2.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping as well
CVE-2022-1793 1 Private Files Project 1 Private Files 2024-11-21 4.3 Medium
The Private Files WordPress plugin through 0.40 is missing CSRF check when disabling the protection, which could allow attackers to make a logged in admin perform such action via a CSRF attack and make the blog public
CVE-2022-1792 1 Quick Subscribe Project 1 Quick Subscribe 2024-11-21 5.4 Medium
The Quick Subscribe WordPress plugin through 1.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and leading to Stored XSS due to the lack of sanitisation and escaping in some of them
CVE-2022-1791 1 One Click Plugin Updater Project 1 One Click Plugin Updater 2024-11-21 8.1 High
The One Click Plugin Updater WordPress plugin through 2.4.14 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and disable / hide the badge of the available updates and the related check.