CVE-2024-3471

LowCVSS 3.4/10Last modified Jun 17, 2026

Description

The Button Generator WordPress plugin before 3.0 does not have CSRF check in place when bulk deleting, which could allow attackers to make a logged in admin delete buttons via a CSRF attack

Metrics

CVSS 3.1 3.4/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Unknown	Button Generator	< 3.0

References

https://wpscan.com/vulnerability/a3c282fb-81b8-48bf-8c18-8366ea8ad9af/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/a3c282fb-81b8-48bf-8c18-8366ea8ad9af/Exploit, Third Party Advisory

Timeline

Published: May 2, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-347107.1Wiki.js is al wiki app built on Node.js. Client side template injection was discovered, that could allow an attacker to inject malicious Jav CVE-2024-347118.2GeoServer is an open source server that allows users to share and edit geospatial data. An improper URI validation vulnerability exists that CVE-2024-347126.5Oceanic is a NodeJS library for interfacing with Discord. Prior to version 1.10.4, input to functions such as `Client.rest.channels.removeBa CVE-2024-347133.5sshproxy is used on a gateway to transparently proxy a user SSH connection on the gateway to an internal host via SSH. Prior to version 1.6.CVE-2024-347147.6The Hoppscotch Browser Extension is a browser extension for Hoppscotch, a community-driven end-to-end open-source API development ecosystem.CVE-2024-347153.3Fides is an open-source privacy engineering platform. The Fides webserver requires a connection to a hosted PostgreSQL database for persiste CVE-2024-347166.1PrestaShop is an open source e-commerce web application. A cross-site scripting (XSS) vulnerability that only affects PrestaShops with custo CVE-2024-347175.3PrestaShop is an open source e-commerce web application. In PrestaShop 8.1.5, any invoice can be downloaded from front-office in anonymous m CVE-2024-347197.8In multiple locations, there is a possible permissions bypass due to a missing null check. This could lead to local escalation of privilege CVE-2024-34725.9The Modal Window WordPress plugin before 5.3.10 does not have CSRF check in place when bulk deleting modals, which could allow attackers to CVE-2024-347207.8In com_android_internal_os_ZygoteCommandBuffer_nativeForkRepeatedly of com_android_internal_os_ZygoteCommandBuffer.cpp, there is a possible CVE-2024-347215.5In ensureFileColumns of MediaProvider.java, there is a possible disclosure of files owned by another user due to improper input validation.