CVSS: 4.3EPSS: %CPEs: 1EXPL: 0CVE-2022-44630 – YITH plugins by YITHEMES <= (Various Versions) - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2022-44630
Several YITHEMES plugins for WordPress are vulnerable to Cross-Site Request Forgery. This is due to missing or incorrect nonce validation on the create_log_file function. This makes it possible for unauthenticated attackers to create an error or debug log file using the plugin, via forged request granted they can trick a site administrator into performing an action such as clicking on a link. The function allows the user to specify the file name. Please note that the unpatched plugins from this developer are the FREE versions of the plugin that were available on the WordPress.org repository. • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 38EXPL: 0CVE-2019-16251 – YIT Plugin Framework <= 3.3.8 - Authenticated Settings Change
https://notcve.org/view.php?id=CVE-2019-16251
plugin-fw/lib/yit-plugin-panel-wc.php in the YIT Plugin Framework through 3.3.8 for WordPress allows authenticated options changes. el archivo plugin-fw/lib/yit-plugin-panel-wc.php en YIT Plugin Framework versiones hasta 3.3.8 para WordPress, permite cambios de opciones autenticados. Various versions of a various YITH WooCommerce plugins that use the YIT Plugin Framework through 3.3.8 are vulnerable to authorization bypass due to a missing capability check in the the 'save_toggle_element_options' function in .plugin-fw/lib/yit-plugin-panel-wc.php. This allows authenticated users with subscriber-level permissions or above to change arbitrary plugin settings. • https://blog.nintechnet.com/authenticated-settings-change-vulnerability-in-yit-plugin-framework https://wpvulndb.com/vulnerabilities/9932 • CWE-862: Missing Authorization •