Instant Css Vulnerabilities

[en] Missing Authorization vulnerability in Dylan Blokhuis Instant CSS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Instant CSS: from n/a through 1.1.4.

Affected:

up to 1.1.5

Fixed in:

1.1.5

Disclosed:

Dec 13, 2024

CVE-2023-38483 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Dylan Blokhuis Instant CSS plugin <= 1.2.1 versions.

Affected:

up to 1.2.2

Fixed in:

1.2.2

Disclosed:

Oct 6, 2023

CVE-2023-44243 on NVD →

The Instant CSS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on several functions called via AJAX actions in the class.instantcss_ajax.php file. This makes it possible for unauthenticated attackers to save...

CVSS:

4.3

Affected:

up to 1.2.1

Fixed in:

1.2.2

Disclosed:

Sep 29, 2023

CVE-2023-44243 on NVD →

The Instant CSS plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on several functions called via AJAX actions in the ~/classes/class.instantcss_ajax.php file in versions up to, and including, 1.1.4. This makes it possible for authenticated attackers, wi...

CVSS:

5.3

Affected:

up to 1.1.4

Fixed in:

1.1.5

Disclosed:

Jul 24, 2023

CVE-2023-38483 on NVD →