Appsero <= 1.2.0 - Cross-Site Request Forgery
The Appsero analytics tool used in several plugins is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the uninstall_reason_submission function used for feedback submission in versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to invoke this function intended for administrator use via forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Plugin de WordPress | Bangladeshi Payment Gateways – Make Payment Using QR Code | <= 2.0.6 | 2.0.7 |
| Plugin de WordPress | Boostify Header Footer Builder for Elementor | <= 1.2.8 | 1.2.9 |
| Plugin de WordPress | Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD | <= 3.1.3 | 3.1.4 |
| Plugin de WordPress | Click to top | <= 1.2.19 | 1.2.20 |
| Plugin de WordPress | Darklup – Enhanced WordPress Dark Mode, Dark Theme, Night Mode & Accessibility Plugin | <= 2.1.1 | 2.1.2 |
| Plugin de WordPress | Markdown Editor (Formerly Dark Mode) | <= 4.1.2 | 4.1.3 |
| Plugin de WordPress | Dashboard Welcome for Elementor | <= 1.0.6 | 1.0.7 |
| Plugin de WordPress | Directorist: AI-Powered Business Directory, Listings & Classified Ads | <= 7.7.1 | 7.7.2 |
| Plugin de WordPress | WP CTA – Call Now Button, Sticky Button & Call to Action Builder | <= 1.5.8 | 1.5.9 |
| Plugin de WordPress | Easy Video Reviews – Testimonial Grid & Social Proof | <= 1.4.2 | 1.5.0 |
| Plugin de WordPress | Exclusive Addons for Elementor | <= 2.6.1 | 2.6.2 |
| Plugin de WordPress | Exclusive Team for Elementor | <= 1.2.4 | sin corrección |
| Plugin de WordPress | Fuse Social Icons | <= 5.4.6 | 5.4.7 |
| Plugin de WordPress | Gallery Box | <= 1.7.30 | 1.7.31 |
| Plugin de WordPress | GS Pinterest Portfolio – Pins Grid, Masonry, User Profile, Popup & Board Widgets | <= 1.6.2 | 1.6.3 |
| Plugin de WordPress | Solid Testimonials – Testimonial Slider, Video Testimonials & Customer Reviews | <= 1.9.7 | 1.9.8 |
| Plugin de WordPress | HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates | <= 3.8.2 | 3.8.3 |
| Plugin de WordPress | Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator | <= 1.4.1 | 1.4.2 |
| Plugin de WordPress | Magical Posts Display – Elementor Advanced Posts widgets | <= 1.2.15 | 1.2.16 |
| Plugin de WordPress | Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider | <= 3.28.0 | 3.28.1 |
| Plugin de WordPress | Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget | <= 1.6.3 | 1.6.4 |
| Plugin de WordPress | PT Addons for Elementor Lite | <= 2.2 | sin corrección |
| Plugin de WordPress | FlexTable – Data Table Sync with Google Sheets | <= 2.12.14 | 2.12.15 |
| Plugin de WordPress | Stax Addons for Elementor | <= 1.4.3 | 1.4.4 |
| Plugin de WordPress | BuddyPress Builder for Elementor – BuddyBuilder | <= 1.7.1 | 1.7.2 |
| Plugin de WordPress | Stylish Cost Calculator – Quote Generator, Lead Gen & Price Estimator | <= 7.3.6 | 7.3.7 |
| Plugin de WordPress | Subscribe2 – Form, Email Subscribers & Newsletters | <= 10.37 | 10.38 |
| Plugin de WordPress | Texty – SMS Notification for WordPress, WooCommerce, Dokan and more | <= 1.1.1 | 1.1.2 |
| Plugin de WordPress | Prime Elementor Addons – Lightweight Elementor Widgets for Faster Pages | <= 1.0.1 | 1.0.2 |
| Plugin de WordPress | Update Image Tag Alt Attribute | <= 2.4.3 | sin corrección |
| Plugin de WordPress | Visibility Logic for Elementor | <= 2.3.3 | 2.3.4 |
| Plugin de WordPress | W4 Post List | <= 2.4.2 | 2.4.3 |
| Plugin de WordPress | Product Category Showcase for WooCommerce | <= 1.1.9 | 2.0.0 |
| Plugin de WordPress | PDF Invoices & Packing Slips for WooCommerce – Challan | <= 3.4.8 | 3.4.9 |
| Plugin de WordPress | FlexMeeting – Webinar & Meeting Plugin for Jitsi Meet | <= 1.2.5 | 2.0.0 |
| Plugin de WordPress | Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker | <= 2.6.12 | 2.6.13 |
| Plugin de WordPress | weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot | >= 1.6, <= 1.7.5 | 1.7.6 |
| Plugin de WordPress | weMail – Email Marketing, Newsletters Builder & Email Automations for WooCommerce | <= 1.14.1 | 1.14.2 |
| Plugin de WordPress | wePOS – Point Of Sale (POS) for WooCommerce & Dokan | <= 1.2.5 | 1.2.6 |
| Plugin de WordPress | Product Category Slider for WooCommerce | <= 4.1.5 | 4.1.6 |
| Plugin de WordPress | Conversion Tracking for WooCommerce | <= 2.0.10 | 2.0.11 |
| Plugin de WordPress | Product Carousel Slider & Grid Ultimate for WooCommerce | <= 1.9.3 | 1.9.4 |
| Plugin de WordPress | Product Gallery Slider, Additional Variation Images for WooCommerce | <= 2.2.6 | 2.2.7 |
| Plugin de WordPress | Wiremo – Product Reviews for WooCommerce | <= 1.4.96 | 1.4.97 |
| Plugin de WordPress | Woostify Sites Library | <= 1.4.3 | 1.4.4 |
| Plugin de WordPress | Worth The Read | <= 1.14 | 1.14.1 |
| Plugin de WordPress | Dark Mode – Improve Accessibility with AI Powered Dark Theme | <= 3.0.4 | 3.0.5 |
| Plugin de WordPress | WPEPP – Essential Security, Password Protect & Login Page Customizer | <= 1.2.3 | 1.2.4 |
| Plugin de WordPress | WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell | = 2.6.4 | 2.6.5 |
| Plugin de WordPress | WP Mail Logging | <= 1.10.5 | 1.11.0 |
| Plugin de WordPress | EasyMedia – Increase Media Upload File Size | Role-Based Upload Limit | Increase Execution Time | <= 1.0.9 | 1.1.0 |
| Plugin de WordPress | User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission | <= 3.6.0 | 3.6.1 |
| Plugin de WordPress | WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress | <= 8.2.5 | 8.2.6 |
| Plugin de WordPress | Zero BS Accounting | <= 1.0.6 | 2.0.0 |
Referencias
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N- Debilidad (CWE)
CWE-352- Plataforma
- WordPress
- Paquete
Bangladeshi Payment Gateways – Make Payment Using QR Code, Boostify Header Footer Builder for Elementor, Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD- Publicada
- 14.12.2022
- Actualizado
- 11.10.2026 10:23
Fuentes y licencias
Wordfence Intelligence - e869800a-6fbc-4a1a-97fd-92ecbf3305ff - Wordfence Intelligence
Copyright 1999-2026 The MITRE Corporation
Copyright 2012-2026 Defiant Inc.
This record contains material that is subject to copyright
Copyright 1999-2026 The MITRE Corporation
CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.
https://www.cve.org/Legal/TermsOfUseCopyright 2012-2026 Defiant Inc.
Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.
https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/Wordfence Intelligence
Wordfence Intelligence - Defiant, Inc. Copyright Defiant, Inc. All rights reserved except as granted below. License grant, section 3.1 of the Wordfence Intelligence Terms and Conditions (January 26, 2026): Subject to this Agreement, Company hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute the Service. Any copy you make for such purposes is authorized provided that you reproduce Company’s copyright designation, this license, and the license of any disclosed Company licensor in any such copy. Full applicable Agreement: https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/
Historial de vulnerabilidades: Markdown Editor (Formerly Dark Mode)
Todas las vulnerabilidades publicadas de este paquete (Plugin de WordPress), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 4
- Primera → última
- 01.2018 12.2022
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Media 4
Divulgaciones por año
- 2018: 2
- 2019: 0
- 2020: 0
- 2021: 0
- 2022: 2
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 0
-
Appsero <= 1.2.0 - Cross-Site Request Forgery esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.