CVE-2024-6075

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Jul 15, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-60766.1The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not sanitise and escape a parameter before outputting it back in the pag CVE-2024-60777.5A denial-of-service vulnerability exists in the Rockwell Automation affected products when specially crafted packets are sent to the CIP Sec CVE-2024-60788.6CVE-2024-6078 IMPACT An improper authentication vulnerability exists in the affected product, which could allow a malicious user to generat CVE-2024-60795.4A vulnerability exists in the Rockwell Automation Emulate3D™, which could be leveraged to execute a DLL Hijacking attack. The application lo CVE-2024-60807.8A vulnerability classified as critical was found in Intelbras InControl 2.21.56. This vulnerability affects unknown code of the component in CVE-2024-60826.1A vulnerability, which was classified as problematic, has been found in PHPVibe 11.0.46. This issue affects some unknown processing of the f CVE-2024-60839.8A vulnerability, which was classified as critical, was found in PHPVibe 11.0.46. Affected is an unknown function of the file /app/uploading/CVE-2024-60849.8A vulnerability has been found in itsourcecode Pool of Bethesda Online Reservation System up to 1.0 and classified as critical. Affected by CVE-2024-60858.6A path traversal vulnerability exists in the XTTS server included in the lollms package, version v9.6. This vulnerability arises from the ab CVE-2024-60864.3In version 1.2.7 of lunary-ai/lunary, any authenticated user, regardless of their role, can change the name of an organization due to improp CVE-2024-60876.5An improper access control vulnerability exists in lunary-ai/lunary at the latest commit (a761d83) on the main branch. The vulnerability all CVE-2024-60885.3The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized user registration due to a missing capability check