CVE-2024-4409

The WP-ViperGB plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.1. This is due to missing or incorrect nonce validation when saving plugin settings. This makes it possible for unauthenticated attackers to change the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3091230%40wp-vipergb%2Ftrunk&old=2812759%40wp-vipergb%2Ftrunk&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e86581bd-94c3-4b05-9590-ca3b62073703?source=cve
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3091230%40wp-vipergb%2Ftrunk&old=2812759%40wp-vipergb%2Ftrunk&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e86581bd-94c3-4b05-9590-ca3b62073703?source=cve

Published

May 24, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-44081In Jitsi Meet before 2.0.9779, the functionality to share a …9.8
• CVE-2024-44082In OpenStack Ironic before 26.0.1 and ironic-python-agent be…4.3
• CVE-2024-44083ida64.dll in Hex-Rays IDA Pro through 8.4 crashes when there…7.5
• CVE-2024-44085ONLYOFFICE Docs before 8.1.0 allows XSS via a GeneratorFunct…6.1
• CVE-2024-44087A vulnerability has been identified in Automation License Ma…9.2
• CVE-2024-44088Malicious script injection ('Cross-site Scripting') vulnerab…6.1
• CVE-2024-44092There is a possible LCS signing enforcement missing due to …7.8
• CVE-2024-44093In ppmp_unprotect_buf of drm/code/drm_fw.c, there is a possi…7.8
• CVE-2024-44094In ppmp_protect_mfcfw_buf of code/drm_fw.c, there is a possi…7.8
• CVE-2024-44095In ppmp_protect_mfcfw_buf of code/drm_fw.c, there is a possi…7.8
• CVE-2024-44096there is a possible arbitrary read due to an insecure defaul…4.4
• CVE-2024-44097According to the researcher: "The TLS connections are encryp…9.8