Swat

**Name of the Vulnerable Software and Affected Versions** Facturación Electrónica Costa Rica versions prior to 2.0.3 **Description** The plugin is susceptible to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a victim into performing actions they did not intend to do. This occurs due to missing or incorrect nonce validation within the (global scope, included by `fvcr admin page html`) function. Unauthenticated attackers can exploit this to modify plugin configurations via forged requests, provided they can induce a site administrator to click a malicious link. Affected settings include API tokens, access tokens, economic activity, Hacienda environment mode, invoice and ticket emission flags, exchange rate, and branch settings. **Recommendations** Update the plugin to a version newer than 2.0.2.

**Name of the Vulnerable Software and Affected Versions** W3SC Elementor to Zoho CRM versions prior to 2.2.1 **Description** The plugin is subject to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a victim into performing actions they did not intend to do. This occurs due to missing or incorrect nonce validation in the `storeInfo()` function. Unauthenticated attackers can exploit this to modify Zoho CRM integration settings by replacing the data center, `client ID`, `client secret`, and `user email` credentials with values controlled by the attacker, provided they can trick a site administrator into clicking a malicious link. **Recommendations** Update the plugin to a version newer than 2.2.0. As a temporary mitigation, restrict access to the plugin settings to only trusted administrators.

**Name of the Vulnerable Software and Affected Versions** Wp Js Detect versions prior to 1.1.0 **Description** The plugin is susceptible to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a victim into performing actions they did not intend to do. This occurs due to missing or incorrect nonce validation within the `plugin settings()` function. Unauthenticated attackers can exploit this by tricking a site administrator into clicking a malicious link, allowing the attacker to update the `wp non js notification text` and `wp non js notification css` variables. This enables the injection of arbitrary content that is displayed unescaped on the website frontend. **Recommendations** Update Wp Js Detect to a version later than 1.0.9.

**Name of the Vulnerable Software and Affected Versions** Book a Room Event Calendar versions prior to 2.0 **Description** The Book a Room Event Calendar plugin for WordPress is subject to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a victim into performing an action they did not intend to. The issue exists in the `settings form()` and `update settings()` functionality due to missing or incorrect nonce validation. A nonce is a unique token used to verify that a request was intentionally sent by the user. The plugin's options page handler uses the `action` POST parameter to call `update settings()`, which saves configuration details—including the external database host, username, password, prefix, database name, encryption key, and registration page URL—via `update option()`. Because the plugin fails to generate or verify nonces, unauthenticated attackers can modify these database connection settings by tricking a site administrator into clicking a malicious link. **Recommendations** Update the plugin to a version later than 1.9. As a temporary workaround, restrict access to the plugin settings page to only essential administrators until the update is applied.

**Name of the Vulnerable Software and Affected Versions** MotorDesk versions prior to 1.1.3 **Description** The MotorDesk plugin for WordPress contains a Cross-Site Request Forgery (CSRF) flaw, which occurs when a web application allows an attacker to induce a user to perform actions they do not intend to. This issue is caused by missing or incorrect nonce validation in the `motordesk admin home()` function. Unauthenticated attackers can exploit this by tricking a site administrator into clicking a link, allowing the attacker to update plugin configuration settings, specifically the search page URI and the custom template directory path. **Recommendations** Update to a version later than 1.1.2. As a temporary workaround, restrict access to the `motordesk admin home()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Google Plus One Bottom versions prior to 0.0.3 **Description** The Google Plus One Bottom plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a victim into executing unwanted actions. This occurs due to missing or incorrect nonce validation within the `googlePlusOneAdmin()` function. Unauthenticated attackers can modify plugin settings stored in the database, specifically the `plusone-lang`, `plusone-callback`, and `plusone-url` variables, by inducing a site administrator to click a malicious link. **Recommendations** Update the plugin to a version later than 0.0.2. As a temporary workaround, restrict access to the `googlePlusOneAdmin()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** EmergencyWP – Dead Man's switch & legacy deliverance versions prior to 1.4.3 **Description** The plugin is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation in the `form settings ui()` function. This allows unauthenticated attackers to modify plugin settings by tricking a site administrator into clicking a malicious link. Affected settings include the minimum access role, the data-erasure-on-uninstall flag, life-check timing values, the mandatory email address, the confirmation page ID, and date/time formats. Nonce validation is a security mechanism used to ensure that a request was intentionally sent by the user and not forged by a third party. **Recommendations** Update to a version later than 1.4.2. As a temporary workaround, restrict access to the `form settings ui()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Remove NoFollow Commenter URL versions prior to 1.1 **Description** The plugin is subject to Cross-Site Request Forgery due to missing or incorrect nonce validation in the `gmz comment settings save()` function. This allows unauthenticated attackers to modify the comment-display setting by tricking a site administrator into clicking a malicious link. **Recommendations** Update to a version later than 1.0. As a temporary workaround, restrict access to the plugin settings to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Laiser Tag versions prior to 1.2.6 **Description** The Laiser Tag plugin for WordPress is subject to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a victim into executing unwanted actions. This occurs due to missing or incorrect nonce validation in the `addOptionsPageFields()` function. Unauthenticated attackers can exploit this by tricking a site administrator into clicking a malicious link, allowing the attacker to update plugin settings such as the API key, tag blacklist, relevance threshold, batch size, and tagging toggles. **Recommendations** Update the plugin to a version later than 1.2.5. As a temporary workaround, restrict access to the plugin settings page to minimize the risk of exploitation.