Visibility Logic Elementor Vulnerabilities

The Visibility Logic for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'toggle_option' admin_post function in versions up to, and including, 2.3.4. This makes it possible for authenticated attackers to modify the plugin's settings.

CVSS:

4.3

Affected:

up to 2.3.5

Fixed in:

2.3.5

Disclosed:

Jul 5, 2023

The Visibility Logic for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.4. This is due to missing or incorrect nonce validation on the toggle_option function. This makes it possible for unauthenticated attackers to change plugin settings via a forged req...

CVSS:

4.3

Affected:

up to 2.3.4

Fixed in:

2.3.5

Disclosed:

Jul 5, 2023

CVE-2022-47169 on NVD →

The Appsero analytics tool used in several plugins is vulnerable to authorization bypass due to a missing capability check on the uninstall_reason_submission function used for feedback submission in versions up to, and including, 1.2.1. This makes it possible for authenticated attackers, with subscriber-level permissio...

CVSS:

4.3

Affected:

up to 2.3.3

Fixed in:

2.3.4

Disclosed:

Dec 16, 2022

The Appsero analytics tool used in several plugins is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the uninstall_reason_submission function used for feedback submission in versions up to, and including, 1.2.0. This makes it possible for unauthenticated attackers to invoke this function inten...

CVSS:

4.3

Affected:

up to 2.3.3

Fixed in:

2.3.4

Disclosed:

Dec 14, 2022

CVE-2022-47150 on NVD →