Process Steps Template Designer Vulnerabilities

[en] The Process Steps Template Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the save() function. This makes it possible for unauthenticated attackers to save field icons via a forged request gr...

Affected:

up to 1.3

Fixed in:

1.3

Disclosed:

Jul 12, 2023

CVE-2021-4413 on NVD →

[en] The Process Steps Template Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This makes it possible for unauthenticated attackers to conduct unspecified attacks via forged request granted they can trick a site administrator into performing an action...

Affected:

up to 1.3

Fixed in:

1.3

Disclosed:

Jun 7, 2023

CVE-2021-4349 on NVD →

Affected:

up to 1.3

Fixed in:

1.3

Disclosed:

Jun 7, 2023

CVE-2021-4342 on NVD →

The Process Steps Template Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This makes it possible for unauthenticated attackers to conduct unspecified attacks via forged request granted they can trick a site administrator into performing an action such...

CVSS:

8.8

Affected:

up to 1.3

Fixed in:

1.3

Disclosed:

Mar 1, 2021

CVE-2021-4349 on NVD →

The Process Steps Template Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the save() function. This makes it possible for unauthenticated attackers to save field icons via a forged request granted...

CVSS:

4.3

Affected:

up to 1.2.1

Fixed in:

1.3

Disclosed:

Mar 1, 2021

CVE-2021-4413 on NVD →

The Process Steps Template Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This makes it possible for unauthenticated attackers to conduct unspecified attacks via forged request granted they can trick a site administrator into performing an action such...

Affected:

up to 1.3

Fixed in:

1.3

Disclosed:

Mar 1, 2021

Cross-Site Request Forgery (CSRF) vulnerability found in WordPress Process Steps Template Designer plugin (versions <= 1.2.1).

Affected:

up to 1.3

Fixed in:

1.3

Disclosed:

Jan 12, 2021

Over 70 plugins and themes were vulnerable to Cross-Site Request Forgery due to improperly implemented nonce protection that could be bypassed.

Affected:

up to 1.3

Fixed in:

1.3