The Ultimate Viral Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on thesave_options() function. This makes it possible for unauthenticated attackers to update the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
The WP SinoType plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the sinotype_config function. This makes it possible for unauthenticated attackers to modify typography settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Cross-Site Request Forgery in the Customify WordPress theme version 0.4.11 allows unauthenticated remote attackers to reset a site's theme customization settings by tricking an authenticated administrator into clicking a malicious link. The flaw is rooted in missing nonce validation on the `reset_customize_section` function in `inc/customizer/class-customizer.php`. No active exploitation has been reported (not in CISA KEV), and an EPSS score of 0.01% (1st percentile) confirms negligible real-world exploitation probability, making this a low-urgency but patchable integrity issue.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Isin Basi Advertisement Information Technologies Trade Inc.