Generate Child Theme Vulnerabilities

The Generate Child Theme plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0. This is due to missing or incorrect nonce validation on the process_create_form() function. This makes it possible for unauthenticated attackers to generate a child theme via a forged request...

CVSS:

4.3

Affected:

up to 2.0

Fixed in:

2.0.1

Disclosed:

Apr 5, 2024

CVE-2024-31279 on NVD →

Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essential Widgets WordPress plugin before 1.9, To Top WordPress plugin before 2.3, Header Enhancement WordPress plugin before...

CVSS:

5.4

Affected:

up to 1.6

Fixed in:

1.6

Disclosed:

Sep 20, 2021

CVE-2021-24752 on NVD →