Freesoul Deactivate Plugins Vulnerabilities

[en] Missing Authorization vulnerability in Jose Mortellaro Freesoul Deactivate Plugins – Plugin manager and cleanup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Freesoul Deactivate Plugins – Plugin manager and cleanup: from n/a through 2.1.3.

Affected:

up to 2.1.4

Fixed in:

2.1.4

Disclosed:

Jan 2, 2025

CVE-2023-46188 on NVD →

The Freesoul Deactivate Plugins – Plugin manager and cleanup plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to 2.1.4 (exclusive). This is due to missing or incorrect nonce validation on the eos_dp_pro_delete_transient function. This makes it possible for unauthenticated attackers to...

CVSS:

4.3

Affected:

up to 2.1.4

Fixed in:

2.1.4

Disclosed:

Oct 17, 2023

CVE-2023-46188 on NVD →

The Freesoul Deactivate Plugins – Plugin manager and cleanup plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to 2.1.4 (exclusive). This is due to missing or incorrect nonce validation on the eos_dp_pro_delete_transient function. This makes it possible for unauthenticated attackers to...

Affected:

up to 2.1.4

Fixed in:

2.1.4

Disclosed:

Oct 17, 2023

[en] Insecure Storage of Sensitive Information vulnerability in Jose Mortellaro Freesoul Deactivate Plugins – Plugin manager and cleanup plugin <= 1.9.4.0 versions.

Affected:

up to 1.9.4.1

Fixed in:

1.9.4.1

Disclosed:

Apr 16, 2023

CVE-2023-22687 on NVD →

The Freesoul Deactivate Plugins plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.9.4.0 via the eos_dp_export_plugins_list function. When an administrator exports a list of installed plugins, the plugin creates a file containing this information with a guessable na...

CVSS:

3.7

Affected:

up to 1.9.4.0

Fixed in:

1.9.4.1

Disclosed:

Jan 13, 2023

CVE-2023-22687 on NVD →

The Freesoul Deactivate Plugins plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.9.4.0 via the eos_dp_export_plugins_list function. When an administrator exports a list of installed plugins, the plugin creates a file containing this information with a guessable na...

Affected:

up to 1.9.4.1

Fixed in:

1.9.4.1

Disclosed:

Jan 13, 2023