W3Speedster Wp Vulnerabilities

The W3SPEEDSTER plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.33. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request g...

CVSS:

6.1

Affected:

up to 7.33

Fix:

No patched version reported

Disclosed:

Jan 16, 2025

CVE-2025-23765 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in W3speedster W3SPEEDSTER allows Cross Site Request Forgery.This issue affects W3SPEEDSTER: from n/a through 7.33.

Affected:

up to 7.33

Fix:

No patched version reported

Disclosed:

Jan 16, 2025

CVE-2025-23765 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in W3speedster W3SPEEDSTER.This issue affects W3SPEEDSTER: from n/a through 7.25.

Affected:

up to 7.27

Fixed in:

7.27

Disclosed:

Nov 19, 2024

CVE-2024-52392 on NVD →

The W3SPEEDSTER plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 7.25. This is due to missing or incorrect nonce validation on the w3PutPreloadCss() function. This makes it possible for unauthenticated attackers to update CSS settings via a forged request granted they c...

CVSS:

4.3

Affected:

up to 7.25

Fixed in:

7.27

Disclosed:

Nov 11, 2024

CVE-2024-52392 on NVD →

[en] The W3SPEEDSTER plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.26 via the 'script' parameter of the hookBeforeStartOptimization() function. This is due to the plugin passing user supplied input to eval(). This makes it possible for authenticated attackers, with...

Affected:

up to 7.27

Fixed in:

7.27

Disclosed:

Oct 30, 2024

CVE-2024-8512 on NVD →

The W3SPEEDSTER plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.26 via the 'script' parameter of the hookBeforeStartOptimization() function. This is due to the plugin passing user supplied input to eval(). This makes it possible for authenticated attackers, with Admin...

CVSS:

9.1

Affected:

up to 7.26

Fixed in:

7.27

Disclosed:

Oct 29, 2024

CVE-2024-8512 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in W3speedster W3SPEEDSTER.This issue affects W3SPEEDSTER: from n/a through 7.19.

Affected:

up to 7.20

Fixed in:

7.20

Disclosed:

Feb 28, 2024

CVE-2024-24708 on NVD →

The W3SPEEDSTER plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.19. This is due to missing or incorrect nonce validation on the 'launch' function. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request granted th...

CVSS:

4.3

Affected:

up to 7.19

Fixed in:

7.20

Disclosed:

Jan 31, 2024

CVE-2024-24708 on NVD →