CVE-2024-2232 | High | 8.1 | 2024-08-05 | The lacks CSRF checks allowing a user to invite any user to any group (including private groups) |
CVE-2024-2376 | High | 8.8 | 2024-07-03 | The WPQA Builder WordPress plugin before 6.1.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted a… |
CVE-2024-2375 | Medium | 5.4 | 2024-07-03 | The WPQA Builder WordPress plugin before 6.1.1 does not sanitise and escape some of its Slider settings, which could allow high privilege users such as contrib… |
CVE-2024-2235 | Medium | 4.3 | 2024-07-03 | The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make users vote on any polls, including those t… |
CVE-2024-2234 | Medium | 5.4 | 2024-07-03 | The Himer WordPress theme before 2.1.1 does not sanitise and escape some of its Post settings, which could allow high privilege users such as Contributor to pe… |
CVE-2024-2233 | Medium | 4.3 | 2024-07-03 | The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions v… |
CVE-2024-2231 | Medium | 6.5 | 2024-07-03 | The allows any authenticated user to join a private group due to a missing authorization check on a function |
CVE-2024-2040 | Medium | 4.3 | 2024-07-03 | The Himer WordPress theme before 2.1.1 does not have CSRF checks in some places, which could allow attackers to make users join private groups via a CSRF attack |
CVE-2022-3343 | Low | 3.5 | 2023-01-09 | The WPQA Builder WordPress plugin before 5.9.3 (which is a companion plugin used with Discy and Himer Discy WordPress themes) incorrectly tries to validate tha… |
CVE-2022-3688 | High | 8.8 | 2022-11-21 | The WPQA Builder WordPress plugin before 5.9 does not have CSRF check when following and unfollowing users, which could allow attackers to make logged in users… |
CVE-2022-2198 | Medium | 4.3 | 2022-08-22 | The WPQA Builder WordPress plugin before 5.7 which is a companion plugin to the Hilmer and Discy , does not check authorization before displaying private messa… |
CVE-2022-1323 | Medium | 6.5 | 2022-08-08 | The Discy WordPress theme before 5.0 lacks authorization checks then processing ajax requests to the discy_update_options action, allowing any logged in users… |
CVE-2022-1598 | Medium | 5.3 | 2022-06-08 | The WPQA Builder WordPress plugin before 5.5 which is a companion to the Discy and Himer , lacks authentication in a REST API endpoint, allowing unauthenticate… |
CVE-2022-1597 | Medium | 6.1 | 2022-06-08 | The WPQA Builder WordPress plugin before 5.4, used as a companion for the Discy and Himer , does not sanitise and escape a parameter on its reset password form… |
CVE-2022-1424 | Medium | 6.5 | 2022-06-08 | The Ask me WordPress theme before 6.8.2 does not perform CSRF checks for any of its AJAX actions, allowing an attacker to trick logged in users to perform vari… |
CVE-2022-1422 | Medium | 6.5 | 2022-06-08 | The Discy WordPress theme before 5.2 does not check for CSRF tokens in the AJAX action discy_reset_options, allowing an attacker to trick an admin into resetti… |
CVE-2022-1421 | Medium | 4.3 | 2022-06-08 | The Discy WordPress theme before 5.2 lacks CSRF checks in some AJAX actions, allowing an attacker to make a logged in admin change arbitrary 's settings includ… |
CVE-2022-1241 | Medium | 6.1 | 2022-06-08 | The Ask me WordPress theme before 6.8.2 does not properly sanitise and escape several of the fields in the Edit Profile page, leading to Reflected Cross-Site S… |
CVE-2022-1425 | Medium | 4.3 | 2022-05-16 | The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the message_id of the wpqa_mes… |
CVE-2022-1349 | Medium | 4.3 | 2022-05-16 | The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the value passed to the image_… |
CVE-2022-1051 | Medium | 5.4 | 2022-05-16 | The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not sanitise and escape the city, phone or profi… |