Appsero <= 1.2.0 - Cross-Site Request Forgery
The Appsero analytics tool used in several plugins is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the uninstall_reason_submission function used for feedback submission in versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to invoke this function intended for administrator use via forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
Czego dotyczy
Kliknij technologię, aby zobaczyć wszystkie dotyczące jej podatności.
| Platforma | Paczka | Podatne wersje | Poprawka w wersji |
|---|---|---|---|
| Wtyczka WordPress | Bangladeshi Payment Gateways – Make Payment Using QR Code | <= 2.0.6 | 2.0.7 |
| Wtyczka WordPress | Boostify Header Footer Builder for Elementor | <= 1.2.8 | 1.2.9 |
| Wtyczka WordPress | Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD | <= 3.1.3 | 3.1.4 |
| Wtyczka WordPress | Click to top | <= 1.2.19 | 1.2.20 |
| Wtyczka WordPress | Darklup – Enhanced WordPress Dark Mode, Dark Theme, Night Mode & Accessibility Plugin | <= 2.1.1 | 2.1.2 |
| Wtyczka WordPress | Markdown Editor (Formerly Dark Mode) | <= 4.1.2 | 4.1.3 |
| Wtyczka WordPress | Dashboard Welcome for Elementor | <= 1.0.6 | 1.0.7 |
| Wtyczka WordPress | Directorist: AI-Powered Business Directory, Listings & Classified Ads | <= 7.7.1 | 7.7.2 |
| Wtyczka WordPress | WP CTA – Call Now Button, Sticky Button & Call to Action Builder | <= 1.5.8 | 1.5.9 |
| Wtyczka WordPress | Easy Video Reviews – Testimonial Grid & Social Proof | <= 1.4.2 | 1.5.0 |
| Wtyczka WordPress | Exclusive Addons for Elementor | <= 2.6.1 | 2.6.2 |
| Wtyczka WordPress | Exclusive Team for Elementor | <= 1.2.4 | brak poprawki |
| Wtyczka WordPress | Fuse Social Icons | <= 5.4.6 | 5.4.7 |
| Wtyczka WordPress | Gallery Box | <= 1.7.30 | 1.7.31 |
| Wtyczka WordPress | GS Pinterest Portfolio – Pins Grid, Masonry, User Profile, Popup & Board Widgets | <= 1.6.2 | 1.6.3 |
| Wtyczka WordPress | Solid Testimonials – Testimonial Slider, Video Testimonials & Customer Reviews | <= 1.9.7 | 1.9.8 |
| Wtyczka WordPress | HappyAddons for Elementor – 160 Elementor Widgets, GSAP Animations & Templates | <= 3.8.2 | 3.8.3 |
| Wtyczka WordPress | Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator | <= 1.4.1 | 1.4.2 |
| Wtyczka WordPress | Magical Posts Display – Elementor Advanced Posts widgets | <= 1.2.15 | 1.2.16 |
| Wtyczka WordPress | Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider | <= 3.28.0 | 3.28.1 |
| Wtyczka WordPress | Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget | <= 1.6.3 | 1.6.4 |
| Wtyczka WordPress | PT Addons for Elementor Lite | <= 2.2 | brak poprawki |
| Wtyczka WordPress | FlexTable – Data Table Sync with Google Sheets | <= 2.12.14 | 2.12.15 |
| Wtyczka WordPress | Stax Addons for Elementor | <= 1.4.3 | 1.4.4 |
| Wtyczka WordPress | BuddyPress Builder for Elementor – BuddyBuilder | <= 1.7.1 | 1.7.2 |
| Wtyczka WordPress | Stylish Cost Calculator – Quote Generator, Lead Gen & Price Estimator | <= 7.3.6 | 7.3.7 |
| Wtyczka WordPress | Subscribe2 – Form, Email Subscribers & Newsletters | <= 10.37 | 10.38 |
| Wtyczka WordPress | Texty – SMS Notification for WordPress, WooCommerce, Dokan and more | <= 1.1.1 | 1.1.2 |
| Wtyczka WordPress | Prime Elementor Addons – Lightweight Elementor Widgets for Faster Pages | <= 1.0.1 | 1.0.2 |
| Wtyczka WordPress | Update Image Tag Alt Attribute | <= 2.4.3 | brak poprawki |
| Wtyczka WordPress | Visibility Logic for Elementor | <= 2.3.3 | 2.3.4 |
| Wtyczka WordPress | W4 Post List | <= 2.4.2 | 2.4.3 |
| Wtyczka WordPress | Product Category Showcase for WooCommerce | <= 1.1.9 | 2.0.0 |
| Wtyczka WordPress | PDF Invoices & Packing Slips for WooCommerce – Challan | <= 3.4.8 | 3.4.9 |
| Wtyczka WordPress | FlexMeeting – Webinar & Meeting Plugin for Jitsi Meet | <= 1.2.5 | 2.0.0 |
| Wtyczka WordPress | Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker | <= 2.6.12 | 2.6.13 |
| Wtyczka WordPress | weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot | >= 1.6, <= 1.7.5 | 1.7.6 |
| Wtyczka WordPress | weMail – Email Marketing, Newsletters Builder & Email Automations for WooCommerce | <= 1.14.1 | 1.14.2 |
| Wtyczka WordPress | wePOS – Point Of Sale (POS) for WooCommerce & Dokan | <= 1.2.5 | 1.2.6 |
| Wtyczka WordPress | Product Category Slider for WooCommerce | <= 4.1.5 | 4.1.6 |
| Wtyczka WordPress | Conversion Tracking for WooCommerce | <= 2.0.10 | 2.0.11 |
| Wtyczka WordPress | Product Carousel Slider & Grid Ultimate for WooCommerce | <= 1.9.3 | 1.9.4 |
| Wtyczka WordPress | Product Gallery Slider, Additional Variation Images for WooCommerce | <= 2.2.6 | 2.2.7 |
| Wtyczka WordPress | Wiremo – Product Reviews for WooCommerce | <= 1.4.96 | 1.4.97 |
| Wtyczka WordPress | Woostify Sites Library | <= 1.4.3 | 1.4.4 |
| Wtyczka WordPress | Worth The Read | <= 1.14 | 1.14.1 |
| Wtyczka WordPress | Dark Mode – Improve Accessibility with AI Powered Dark Theme | <= 3.0.4 | 3.0.5 |
| Wtyczka WordPress | WPEPP – Essential Security, Password Protect & Login Page Customizer | <= 1.2.3 | 1.2.4 |
| Wtyczka WordPress | WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell | = 2.6.4 | 2.6.5 |
| Wtyczka WordPress | WP Mail Logging | <= 1.10.5 | 1.11.0 |
| Wtyczka WordPress | EasyMedia – Increase Media Upload File Size | Role-Based Upload Limit | Increase Execution Time | <= 1.0.9 | 1.1.0 |
| Wtyczka WordPress | User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission | <= 3.6.0 | 3.6.1 |
| Wtyczka WordPress | WPVR – 360 Panorama viewer and Virtual Tour Builder for WordPress | <= 8.2.5 | 8.2.6 |
| Wtyczka WordPress | Zero BS Accounting | <= 1.0.6 | 2.0.0 |
Odnośniki
- Wektor CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N- Słabość (CWE)
CWE-352- Platforma
- WordPress
- Paczka
Bangladeshi Payment Gateways – Make Payment Using QR Code, Boostify Header Footer Builder for Elementor, Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD- Ujawniono
- 14.12.2022
- Aktualizacja
- 11.10.2026 10:23
Źródła i licencje
Wordfence Intelligence - e869800a-6fbc-4a1a-97fd-92ecbf3305ff - Wordfence Intelligence
Copyright 1999-2026 The MITRE Corporation
Copyright 2012-2026 Defiant Inc.
This record contains material that is subject to copyright
Copyright 1999-2026 The MITRE Corporation
CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.
https://www.cve.org/Legal/TermsOfUseCopyright 2012-2026 Defiant Inc.
Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.
https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/Wordfence Intelligence
Wordfence Intelligence - Defiant, Inc. Copyright Defiant, Inc. All rights reserved except as granted below. License grant, section 3.1 of the Wordfence Intelligence Terms and Conditions (January 26, 2026): Subject to this Agreement, Company hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute the Service. Any copy you make for such purposes is authorized provided that you reproduce Company’s copyright designation, this license, and the license of any disclosed Company licensor in any such copy. Full applicable Agreement: https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/
Historia podatności: Click to top
Wszystkie opisane podatności tej paczki (Wtyczka WordPress), od najnowszej. Widać, czy to jednorazowa wpadka, czy paczka, której trzeba pilnować.
- Wszystkich wpisów
- 3
- Pierwsza → ostatnia
- 08.2020 12.2022
- Bez poprawki
- 0
- Wykorzystywana w atakach
- 0
Rozkład istotności
- Średnia 3
Ujawnienia w latach
- 2020: 1
- 2021: 0
- 2022: 2
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 0
-
Appsero <= 1.2.0 - Cross-Site Request Forgery ten wpis
Dowiedz się, które podatności dotyczą Twojej aplikacji
Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.