Elasticpress
Monthly
Sensitive data exposure in the ElasticPress WordPress plugin (versions through 5.3.4) allows unauthenticated network attackers to retrieve embedded sensitive information from plugin responses. The root cause is CWE-201: the plugin inserts confidential data into outbound payloads - likely search query results or API responses passed to Elasticsearch/OpenSearch - where it becomes accessible without authentication. Reported by Patchstack with a CVSS 5.3 Medium rating; no public exploit code or active exploitation confirmed at time of analysis.
Cross-Site Request Forgery (CSRF) vulnerability in 10up ElasticPress elasticpress.1.1. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The ElasticPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.3. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
Sensitive data exposure in the ElasticPress WordPress plugin (versions through 5.3.4) allows unauthenticated network attackers to retrieve embedded sensitive information from plugin responses. The root cause is CWE-201: the plugin inserts confidential data into outbound payloads - likely search query results or API responses passed to Elasticsearch/OpenSearch - where it becomes accessible without authentication. Reported by Patchstack with a CVSS 5.3 Medium rating; no public exploit code or active exploitation confirmed at time of analysis.
Cross-Site Request Forgery (CSRF) vulnerability in 10up ElasticPress elasticpress.1.1. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The ElasticPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.3. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.