Dashboard To Do List Vulnerabilities

[en] Missing Authorization vulnerability in Andrew Rapps Dashboard To-Do List.This issue affects Dashboard To-Do List: from n/a through 1.2.0.

Affected:

up to 1.3.0

Fixed in:

1.3.0

Disclosed:

Jun 10, 2024

CVE-2024-35723 on NVD →

The Dashboard To-Do List plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ardtdw_widgetsetup() function in versions up to, and including, 1.2.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to edit widget data...

CVSS:

4.3

Affected:

up to 1.2.0

Fixed in:

1.3.0

Disclosed:

Jun 6, 2024

CVE-2024-35723 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Andrew Rapps Dashboard To-Do List.This issue affects Dashboard To-Do List: from n/a through 1.3.1.

Affected:

up to 1.3.2

Fixed in:

1.3.2

Disclosed:

Apr 15, 2024

CVE-2024-31376 on NVD →

The Dashboard To-Do List plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.1. This is due to missing or incorrect nonce validation on the ardtdw_widgetupdate()function. This makes it possible for unauthenticated attackers to update widgets via a forged request grante...

CVSS:

4.3

Affected:

up to 1.3.1

Fixed in:

1.3.2

Disclosed:

Apr 10, 2024

CVE-2024-31376 on NVD →