Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function
Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for unauthenticated attackers to install plugins from the limited list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Redirection
Vendor
inisev
Product
Redirection
Platforms
Unknown
Default status
unaffected
Redirection · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
1.1.3
None listed
Pop-up
Vendor
inisev
Product
Pop-up
Platforms
Unknown
Default status
unaffected
Pop-up · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
1.1.9
None listed
BackupBliss – Backup & Migration with Free Cloud Storage
Vendor
inisev
Product
BackupBliss – Backup & Migration with Free Cloud Storage
Platforms
Unknown
Default status
unaffected
BackupBliss – Backup & Migration with Free Cloud Storage · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
1.2.7
None listed
Duplicate Post
Vendor
inisev
Product
Duplicate Post
Platforms
Unknown
Default status
unaffected
Duplicate Post · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
1.3.9
None listed
Enhanced Text Widget
Vendor
cl272
Product
Enhanced Text Widget
Platforms
Unknown
Default status
unaffected
Enhanced Text Widget · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
1.5.7
None listed
Ultimate Posts Widget
Vendor
cl272
Product
Ultimate Posts Widget
Platforms
Unknown
Default status
unaffected
Ultimate Posts Widget · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
2.2.4
None listed
Clone
Vendor
migrate
Product
Clone
Platforms
Unknown
Default status
unaffected
Clone · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
2.3.7
None listed
Social Media Share Buttons & Social Sharing Icons
Vendor
inisev
Product
Social Media Share Buttons & Social Sharing Icons
Platforms
Unknown
Default status
unaffected
Social Media Share Buttons & Social Sharing Icons · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
2.8.1
None listed
SSL Mixed Content Fix
Vendor
steve85b
Product
SSL Mixed Content Fix
Platforms
Unknown
Default status
unaffected
SSL Mixed Content Fix · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
3.2.3
None listed
Social Share Icons & Social Share Buttons
Vendor
inisev
Product
Social Share Icons & Social Share Buttons
Platforms
Unknown
Default status
unaffected
Social Share Icons & Social Share Buttons · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
Unavailable
3.5.7
None listed
RSS Redirect & Feedburner Alternative
Vendor
s-feeds
Product
RSS Redirect & Feedburner Alternative
Platforms
Unknown
Default status
unaffected
RSS Redirect & Feedburner Alternative · Scoped product and version facts