CVE-2024-4218

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The AffiEasy plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.6. This is due to plugin improperly releasing the tagged and patched version of the plugin - the vulnerable version is used as the core files, while the patched version was included in a 'trunk' folder. This makes it possible for unauthenticated attackers to perform a variety of actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: May 30, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-421809.8HCL MyXalytics is affected by a malicious file upload vulnerability. The application accepts invalid file uploads, including incorrect cont CVE-2024-421817.5HCL MyXalytics is affected by a cleartext transmission of sensitive information vulnerability. The application transmits sensitive or secur CVE-2024-421822.5BigFix Patch Download Plug-ins are affected by Server-Side Request Forgery (SSRF) vulnerability. It may allow the application to download f CVE-2024-421832.5BigFix Patch Download Plug-ins are affected by an arbitrary file download vulnerability. It could allow a malicious operator to download fi CVE-2024-421842.5BigFix Patch Download Plug-ins are affected by insecure support for file URI scheme. It could allow a malicious operator to attempt to down CVE-2024-421852.5BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML injection attacks. This allows an attacker t CVE-2024-421862.8BigFix Patch Download Plug-ins are affected by an insecure protocol support. The application can allow improper handling of SSL certificate CVE-2024-421875.3BigFix Patch Download Plug-ins are affected by path traversal vulnerability. The application could allow operators to download files from a CVE-2024-421884.6HCL Connections is vulnerable to a broken access control vulnerability that may allow an unauthorized user to update data in certain scenari CVE-2024-421896.5HCL BigFix Web Reports might be subject to a Denial of Service (DoS) attack, due to a potentially weak validation of an API parameter.CVE-2024-42199.1Prior to 23.2, it is possible to perform arbitrary Server-Side requests via HTTP-based connectors within BeyondInsight, resulting in a serve CVE-2024-421909.8HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace