Quicksand Post Filter jQuery Plugin <= 3.1.1 - Missing Authorization via quicksand_admin_ajax
critical
The Quicksand Post Filter jQuery Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'quicksand_admin_ajax' function in versions up to, and including, 3.1.1. This makes it possible for unauthenticated attackers to delete arbitrary site options.
- CVSS:
- 9.1
- Affected:
- up to 3.1.1
- Fix:
- No patched version reported
- Disclosed:
- Feb 2, 2024
CVE-2024-24850 on NVD →
Quicksand Post Filter jQuery Plugin <= 3.1.1 - Cross-Site Request Forgery via renderAdmin
medium
The Quicksand Post Filter jQuery Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1.1. This is due to missing or incorrect nonce validation on the 'renderAdmin' function. This makes it possible for unauthenticated attackers to update arbitrary site options via...
- CVSS:
- 6.5
- Affected:
- up to 3.1.1
- Fix:
- No patched version reported
- Disclosed:
- Feb 2, 2024
CVE-2024-24849 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database