Appsero <= 1.2.0 - Cross-Site Request Forgery
The Appsero analytics tool used in several plugins is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the uninstall_reason_submission function used for feedback submission in versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to invoke this function intended for administrator use via forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
Betroffene Software
Klicken Sie auf eine Technologie, um alle zugehörigen Schwachstellen anzuzeigen.
| Plattform | Paket | Anfällige Versionen | Behoben in |
|---|---|---|---|
| WordPress-Plugin | Bangladeshi Payment Gateways – Make Payment Using QR Code | <= 2.0.6 | 2.0.7 |
| WordPress-Plugin | Boostify Header Footer Builder for Elementor | <= 1.2.8 | 1.2.9 |
| WordPress-Plugin | Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD | <= 3.1.3 | 3.1.4 |
| WordPress-Plugin | Click to top | <= 1.2.19 | 1.2.20 |
| WordPress-Plugin | Darklup – Enhanced WordPress Dark Mode, Dark Theme, Night Mode & Accessibility Plugin | <= 2.1.1 | 2.1.2 |
| WordPress-Plugin | Markdown Editor (Formerly Dark Mode) | <= 4.1.2 | 4.1.3 |
| WordPress-Plugin | Dashboard Welcome for Elementor | <= 1.0.6 | 1.0.7 |
| WordPress-Plugin | Directorist: AI-Powered Business Directory, Listings & Classified Ads | <= 7.7.1 | 7.7.2 |
| WordPress-Plugin | WP CTA – Call Now Button, Sticky Button & Call to Action Builder | <= 1.5.8 | 1.5.9 |
| WordPress-Plugin | Easy Video Reviews – Testimonial Grid & Social Proof | <= 1.4.2 | 1.5.0 |
| WordPress-Plugin | Exclusive Addons for Elementor | <= 2.6.1 | 2.6.2 |
| WordPress-Plugin | Exclusive Team for Elementor | <= 1.2.4 | keine Korrektur |
| WordPress-Plugin | Fuse Social Icons | <= 5.4.6 | 5.4.7 |
| WordPress-Plugin | Gallery Box | <= 1.7.30 | 1.7.31 |
| WordPress-Plugin | GS Pinterest Portfolio – Pins Grid, Masonry, User Profile, Popup & Board Widgets | <= 1.6.2 | 1.6.3 |
| WordPress-Plugin | Solid Testimonials – Testimonial Slider, Video Testimonials & Customer Reviews | <= 1.9.7 | 1.9.8 |
| WordPress-Plugin | HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates | <= 3.8.2 | 3.8.3 |
| WordPress-Plugin | Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator | <= 1.4.1 | 1.4.2 |
| WordPress-Plugin | Magical Posts Display – Elementor Advanced Posts widgets | <= 1.2.15 | 1.2.16 |
| WordPress-Plugin | Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider | <= 3.28.0 | 3.28.1 |
| WordPress-Plugin | Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget | <= 1.6.3 | 1.6.4 |
| WordPress-Plugin | PT Addons for Elementor Lite | <= 2.2 | keine Korrektur |
| WordPress-Plugin | FlexTable – Data Table Sync with Google Sheets | <= 2.12.14 | 2.12.15 |
| WordPress-Plugin | Stax Addons for Elementor | <= 1.4.3 | 1.4.4 |
| WordPress-Plugin | BuddyPress Builder for Elementor – BuddyBuilder | <= 1.7.1 | 1.7.2 |
| WordPress-Plugin | Stylish Cost Calculator – Quote Generator, Lead Gen & Price Estimator | <= 7.3.6 | 7.3.7 |
| WordPress-Plugin | Subscribe2 – Form, Email Subscribers & Newsletters | <= 10.37 | 10.38 |
| WordPress-Plugin | Texty – SMS Notification for WordPress, WooCommerce, Dokan and more | <= 1.1.1 | 1.1.2 |
| WordPress-Plugin | Prime Elementor Addons – Lightweight Elementor Widgets for Faster Pages | <= 1.0.1 | 1.0.2 |
| WordPress-Plugin | Update Image Tag Alt Attribute | <= 2.4.3 | keine Korrektur |
| WordPress-Plugin | Visibility Logic for Elementor | <= 2.3.3 | 2.3.4 |
| WordPress-Plugin | W4 Post List | <= 2.4.2 | 2.4.3 |
| WordPress-Plugin | Product Category Showcase for WooCommerce | <= 1.1.9 | 2.0.0 |
| WordPress-Plugin | PDF Invoices & Packing Slips for WooCommerce – Challan | <= 3.4.8 | 3.4.9 |
| WordPress-Plugin | FlexMeeting – Webinar & Meeting Plugin for Jitsi Meet | <= 1.2.5 | 2.0.0 |
| WordPress-Plugin | Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker | <= 2.6.12 | 2.6.13 |
| WordPress-Plugin | weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot | >= 1.6, <= 1.7.5 | 1.7.6 |
| WordPress-Plugin | weMail – Email Marketing, Newsletters Builder & Email Automations for WooCommerce | <= 1.14.1 | 1.14.2 |
| WordPress-Plugin | wePOS – Point Of Sale (POS) for WooCommerce & Dokan | <= 1.2.5 | 1.2.6 |
| WordPress-Plugin | Product Category Slider for WooCommerce | <= 4.1.5 | 4.1.6 |
| WordPress-Plugin | Conversion Tracking for WooCommerce | <= 2.0.10 | 2.0.11 |
| WordPress-Plugin | Product Carousel Slider & Grid Ultimate for WooCommerce | <= 1.9.3 | 1.9.4 |
| WordPress-Plugin | Product Gallery Slider, Additional Variation Images for WooCommerce | <= 2.2.6 | 2.2.7 |
| WordPress-Plugin | Wiremo – Product Reviews for WooCommerce | <= 1.4.96 | 1.4.97 |
| WordPress-Plugin | Woostify Sites Library | <= 1.4.3 | 1.4.4 |
| WordPress-Plugin | Worth The Read | <= 1.14 | 1.14.1 |
| WordPress-Plugin | Dark Mode – Improve Accessibility with AI Powered Dark Theme | <= 3.0.4 | 3.0.5 |
| WordPress-Plugin | WPEPP – Essential Security, Password Protect & Login Page Customizer | <= 1.2.3 | 1.2.4 |
| WordPress-Plugin | WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell | = 2.6.4 | 2.6.5 |
| WordPress-Plugin | WP Mail Logging | <= 1.10.5 | 1.11.0 |
| WordPress-Plugin | EasyMedia – Increase Media Upload File Size | Role-Based Upload Limit | Increase Execution Time | <= 1.0.9 | 1.1.0 |
| WordPress-Plugin | User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission | <= 3.6.0 | 3.6.1 |
| WordPress-Plugin | WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress | <= 8.2.5 | 8.2.6 |
| WordPress-Plugin | Zero BS Accounting | <= 1.0.6 | 2.0.0 |
Verweise
- CVSS-Vektor
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N- Schwäche (CWE)
CWE-352- Plattform
- WordPress
- Paket
Bangladeshi Payment Gateways – Make Payment Using QR Code, Boostify Header Footer Builder for Elementor, Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD- Veröffentlicht
- 14.12.2022
- Aktualisiert
- 11.10.2026 10:23
Quellen und Lizenzen
Wordfence Intelligence - e869800a-6fbc-4a1a-97fd-92ecbf3305ff - Wordfence Intelligence
Copyright 1999-2026 The MITRE Corporation
Copyright 2012-2026 Defiant Inc.
This record contains material that is subject to copyright
Copyright 1999-2026 The MITRE Corporation
CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.
https://www.cve.org/Legal/TermsOfUseCopyright 2012-2026 Defiant Inc.
Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.
https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/Wordfence Intelligence
Wordfence Intelligence - Defiant, Inc. Copyright Defiant, Inc. All rights reserved except as granted below. License grant, section 3.1 of the Wordfence Intelligence Terms and Conditions (January 26, 2026): Subject to this Agreement, Company hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute the Service. Any copy you make for such purposes is authorized provided that you reproduce Company’s copyright designation, this license, and the license of any disclosed Company licensor in any such copy. Full applicable Agreement: https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/
Schwachstellenhistorie: Markdown Editor (Formerly Dark Mode)
Alle veröffentlichten Schwachstellen dieses Pakets (WordPress-Plugin), neueste zuerst. Zeigt, ob es ein einmaliger Ausrutscher ist oder ein Paket, das man im Auge behalten muss.
- Einträge insgesamt
- 4
- Erste → letzte
- 01.2018 12.2022
- Ohne Fix
- 0
- In Angriffen ausgenutzt
- 0
Verteilung nach Schweregrad
- Mittel 4
Veröffentlichungen pro Jahr
- 2018: 2
- 2019: 0
- 2020: 0
- 2021: 0
- 2022: 2
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 0
-
Appsero <= 1.2.0 - Cross-Site Request Forgery dieser Eintrag
Erkennen Sie Schwachstellen in Ihrer Anwendung
Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.