CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-7492 – MainWP Child Reports <= 2.2 - Cross-Site Request Forgery to Arbitrary Options Update
https://notcve.org/view.php?id=CVE-2024-7492
The MainWP Child Reports plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or incorrect nonce validation on the network_options_action() function. This makes it possible for unauthenticated attackers to update arbitrary options that can be leveraged for privilege escalation via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This is only exploitable on multisite instances. El complemento MainWP Child Reports para WordPress es vulnerable a Cross-Site Request Forgery en todas las versiones hasta la 2.2 incluida. • https://plugins.trac.wordpress.org/browser/mainwp-child-reports/trunk/classes/class-network.php#L346 https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3131718%40mainwp-child-reports&new=3131718%40mainwp-child-reports&sfp_email=&sfph_mail=#file4 https://www.wordfence.com/threat-intel/vulnerabilities/id/cdd7971c-6f1c-437a-832c-e2b2817a197e?source=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-33680 – WordPress MainWP Child Reports plugin <= 2.1.1 - Cross Site Request Forgery (CSRF) vulnerability
https://notcve.org/view.php?id=CVE-2024-33680
Cross-Site Request Forgery (CSRF) vulnerability in MainWP MainWP Child Reports.This issue affects MainWP Child Reports: from n/a through 2.1.1. Vulnerabilidad de Cross-Site Request Forgery (CSRF) en MainWP MainWP Child Reports. Este problema afecta a MainWP Child Reports: desde n/a hasta 2.1.1. The MainWP Child Reports plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing or incorrect nonce validation on the uninstall() function. • https://patchstack.com/database/vulnerability/mainwp-child-reports/wordpress-mainwp-child-reports-plugin-2-1-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24754 – MainWP Child Reports < 2.0.8 - Admin+ SQL Injection
https://notcve.org/view.php?id=CVE-2021-24754
The MainWP Child Reports WordPress plugin before 2.0.8 does not validate or sanitise the order parameter before using it in a SQL statement in the admin dashboard, leading to an SQL injection issue El plugin MainWP Child Reports de WordPress versiones anteriores a 2.0.8, no comprueba ni sanea el parámetro order antes de usarlo en una sentencia SQL en el panel de administración, conllevando a un problema de inyección SQL • https://wpscan.com/vulnerability/132118aa-4b72-4eaa-8aa1-6ad7b0c7f495 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •