Jerome Bruandet

The issue is due to missing or incorrect nonce validation on the `save()` function, making it possible for unauthenticated attackers to save code snippets via a forged request if they can trick a site administrator into performing an action such as clicking on a link.

The issue is due to missing or incorrect nonce validation on the `save feedzy post type meta()` function, making it possible for unauthenticated attackers to update post meta via a forged request if they can trick a site administrator into performing an action such as clicking on a link.

The issue is due to missing or incorrect nonce validation on the `save meta()` function, making it possible for unauthenticated attackers to save meta fields via a forged request if they can trick a site administrator into performing an action such as clicking on a link.

The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the `czr fn post fields save()` function. This allows unauthenticated attackers to post fields via a forged request if they can trick a site administrator into performing an action such as clicking on a link.

The issue is related to an incorrect capability check on the `is administrator()` function, which allows authenticated attackers to bypass authorization and access available AJAX functions. This enables them to interact with these functions in an unauthorized manner.

The issue is due to missing or incorrect nonce validation on the `runActions()` function, making it possible for unauthenticated attackers to activate and deactivate snippets via a forged request if they can trick a site administrator into performing an action such as clicking on a link.

The issue is due to missing or incorrect nonce validation on the `save meta box()` function, making it possible for unauthenticated attackers to save metabox data via a forged request if they can trick a site administrator into performing an action such as clicking on a link.

The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the `pmpro page save()` function. This allows unauthenticated attackers to save pages via a forged request if they can trick a site administrator into performing an action, such as clicking on a link.

The issue arises from missing authorization on the `export()` function, allowing unauthenticated attackers to export the plugin's settings. This affects the WooCommerce Dynamic Pricing and Discounts plugin for WordPress.

The issue is related to arbitrary file uploads due to missing file type validation in the ~/admin/resources/jscript/ajaxupload/sf-uploader.php file. This allows attackers to upload arbitrary files on the affected site's server, which may make remote code execution possible.

The issue is due to missing capability checks on several AJAX actions and nonce disclosure in the source page of the administrative dashboard. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to call functions and delete and/or upload files.

The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the `update answer()` function. This allows unauthenticated attackers to update answers to questions via a forged request if they can trick a site administrator into performing a specific action.

The issue is due to missing or incorrect nonce validation on the `add core extensions bundle validation()` function, making it possible for unauthenticated attackers to validate extension bundles via a forged request. This can happen if an attacker can trick a site administrator into performing an action, such as clicking on a link.

The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the `saveCustomFields()` function. This allows unauthenticated attackers to save custom fields via a forged request if they can trick a site administrator into performing a specific action.

The issue is due to missing or incorrect nonce validation on the `ewww ngg bulk init()` function, making it possible for unauthenticated attackers to perform bulk image optimization via a forged request. This can be achieved if an attacker can trick a site administrator into performing an action, such as clicking on a link.

The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the `tptn export tables()` function. This allows unauthenticated attackers to generate an export of the top 10 table via a forged request if they can trick a site administrator into performing an action such as clicking on a link.

The issue arises from missing or incorrect nonce validation on the `etcpf delete feed()` function, allowing unauthenticated attackers to delete an export feed via a forged request if they can trick a site administrator into performing a specific action, such as clicking on a link.

The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the `admin add order item()` function. This allows unauthenticated attackers to add an order item via a forged request if they can trick a site administrator into performing an action, such as clicking on a link.

The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the `create csv file()` function. This allows unauthenticated attackers to create a CSV file via a forged request if they can trick a site administrator into performing an action, such as clicking on a link.

The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the `save meta box()` function. This allows unauthenticated attackers to save meta boxes via a forged request if they can trick a site administrator into performing a specific action.