DedeCMS v6.1.9 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add Administrator accounts and modify Admin passwords.

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?

CVE-2022-43031: GitHub - cai-niao98/Dedecmsv6: Dedecmsv6

Cross-Site Request Forgery (CSRF) vulnerability in Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 on WordPress leading to rule type migration.

 Verified

 Fixed

**5.4**

CVSS 3.1 score Medium severity

Report  

Monitoring Not reported to be exploited

Vulnerable versions

<= 4.1.5

PSID 

13403873238a

Classification 

Cross Site Request Forgery (CSRF)

OWASP Top 10 

A5: Broken Access Control

Publicly disclosed

2022-10-30

**Details**

Cross-Site Request Forgery (CSRF) vulnerability leading to Rule Type Migration discovered by Muhammad Daffa (Patchstack Alliance) in WordPress Advanced Dynamic Pricing for WooCommerce plugin (versions <= 4.1.5).

**Solution**

Update the WordPress Advanced Dynamic Pricing for WooCommerce plugin to the latest available version (at least 4.1.6).

**References**

CVE-2022-43488: WordPress Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 - Cross-Site Request Forgery (CSRF) vulnerability - Patchstack

CSRF attacks could be triggered to access and exfiltrate information

CSRF attacks could be triggered to access and exfiltrate information

A security researcher has disclosed a CSS injection flaw in Acronis software which could be abused for data theft.

On November 4, ‘Medi’ (under the alias ‘mr-medi’), published a technical analysis of the vulnerability, a client-side path traversal attack they described as the “favorite bug” they’ve ever found.

The vulnerability existed in the Acronis cloud management console. The software manages Acronis services, including cloud backups and resource monitoring.

**Path traversal**

According to the researcher, a web-facing URL would automatically pull a parameter called . Then, when the request is underway, a CSS file is also requested and loaded.

However, when this CSS file is asked for, the front-end code doesn’t sanitize the values, so it is possible for an attacker to perform a path traversal by requesting the same file from a different path.

This relative path overwrite isn’t intrinsically an important bug unless you combine it with an open redirect, which allows attackers to issue a request and force a redirect to an external domain where a malicious CSS file is stored.

Catch up on the latest web security research

Medi discovered a vulnerable API endpoint and Location HTTP header combination in which the user can control the parameter. This allowed the researcher to create an exploit with the color\_scheme parameter and a redirect, pointing to the domain so user information could be exfiltrated “by using CSS properties”.

Information could include cross-site request forgery (CSRF) tokens, personal data, partner hashes, and other data located in the Document Object Model (DOM) where the crafted CSS file is injected.

“If we specify our CSS file in a domain hosted by us, we can perform the CSRF attack via requests by loading an external image using CSS properties like , or exfiltrate user information like \[an\] IP, Referer header or User Agent,” the researcher explained. “I used my local server but you can check it out in any external domain you own.”

**Chain reaction**

A video-based Proof-of-Concept (PoC) attack has been published. Medi has also suggested that this technique could be chained with relative path overwrites and path-relative stylesheet import (PRSSI) vulnerabilities.

Medi told The Daily Swig: “Since this is an attack relying on the client side, the main risk is \[being able to\] exfiltrate information found in the vulnerable page and CSRF attacks. The type of bug depends on how the JavaScript handles the user input and the purpose of that parameter.

“For example, in Acronis, the vulnerable page was the admin dashboard containing valuable information about their customers \[and\] the parameter was used to dynamically apply styles \[...\] Other scenarios may involve leading to XSS with more serious issues like CSRF with any HTTP method.”

Medi’s findings were disclosed privately via the HackerOne platform and the flaw was patched on January 13. A $250 bug bounty was awarded.

Medi confirmed the bug had been resolved. On HackerOne, the Acronis team likened the security flaw to a reflected cross-site scripting (XSS) attack, which, despite the possibility of user data exfiltration when the color\_scheme is in use, accounts for the relatively low bug bounty.

The Daily Swig has reached out to Acronis for further comment and we will update this story as and when we hear back.

YOU MAY ALSO LIKE Gatsby patches SSRF, XSS bugs in Cloud Image CDN

CSS injection flaw patched in Acronis cloud management console

Cross-Site Request Forgery (CSRF) vulnerability in CodeAndMore WP Page Widget plugin <= 3.9 on WordPress leading to plugin settings change.

 Verified

 Fixed

**5.4**

CVSS 3.1 score Medium severity

Report  

Monitoring Not reported to be exploited

Vulnerable versions

<= 3.9

PSID 

14a0f5ad99e0

Classification 

Cross Site Request Forgery (CSRF)

OWASP Top 10 

A5: Broken Access Control

Publicly disclosed

2022-09-26

**Details**

Cross-Site Request Forgery (CSRF) vulnerability was discovered by Muhammad Daffa (Patchstack Alliance) in the WordPress WP Page Widget plugin (versions <= 3.9).

**Solution**

Update the WordPress WP Page Widget plugin to the latest available version (at least 4.0).

**References**

CVE-2022-32587: WordPress WP Page Widget plugin <= 3.9 - Cross-Site Request Forgery (CSRF) vulnerability - Patchstack

Cross-Site Request Forgery (CSRF) vulnerability in Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 on WordPress leading to plugin settings import.

CVE-2022-43491: Advanced Dynamic Pricing for WooCommerce

Cross-Site Request Forgery (CSRF) vulnerability in Advanced Coupons for WooCommerce Coupons plugin <= 4.5 on WordPress leading to notice dismissal.

 Verified

 Fixed

**5.4**

CVSS 3.1 score Medium severity

Report  

Monitoring Not reported to be exploited

Vulnerable versions

<= 4.5

PSID 

3b127f9dd3e7

Classification 

Cross Site Request Forgery (CSRF)

OWASP Top 10 

A5: Broken Access Control

Publicly disclosed

2022-10-30

**Details**

Cross-Site Request Forgery (CSRF) vulnerability leading to Notice Dismissal discovered by Muhammad Daffa (Patchstack Alliance) in WordPress Advanced Coupons for WooCommerce Coupons plugin (versions <= 4.5).

**Solution**

Update the WordPress Advanced Coupons for WooCommerce Coupons plugin to the latest available version (at least 4.5.0.1).

**References**

CVE-2022-43481: WordPress Advanced Coupons for WooCommerce Coupons plugin <= 4.5 - Cross-Site Request Forgery (CSRF) vulnerability - Patchstack

Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Vladimir Anokhin's Shortcodes Ultimate plugin <= 5.12.0 on WordPress.

 Verified

 Fixed

**6.1**

CVSS 3.1 score Medium severity

Report  

Monitoring Not reported to be exploited

Vulnerable versions

<= 5.12.0

PSID 

42eec00642ac

Classification 

Cross Site Request Forgery (CSRF)

OWASP Top 10 

A5: Broken Access Control

Publicly disclosed

2022-10-13

**Details**

Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) vulnerability discovered by Dave Jong (Patchstack) in WordPress Shortcodes Ultimate plugin (versions <= 5.12.0).

**Solution**

Update the WordPress Shortcodes Ultimate plugin to the latest available version (at least 5.12.1).

**References**

CVE-2022-41136: WordPress Shortcodes Ultimate plugin <= 5.12.0 - CSRF vulnerability leading to Stored XSS - Patchstack

Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) in David Anderson Testimonial Slider plugin <= 1.3.1 on WordPress.

*   Details
*   Reviews
*   Support
*   Development

This plugin has been closed as of November 7, 2022 and is not available for download. This closure is temporary, pending a full review.

worked first time, no issues, thank you 🙂

Its Awesome plugin. I highly recommend this.

Es facil de usar, cómodo y cumple su cometido con creces. Gracias por hacerlo

I have used this plugin for close to a year. It is the only one that I have used flawlessly with all my websites. I would recommend it to anyone who wants a simple plugin that creates wonderful testimonial sliders

They should tell you the free version is not responsive before you spend an hour setting it up.

Read all 68 reviews

“Testimonial Slider” is open source software. The following people have contributed to this plugin.

Contributors

CVE-2022-44741: Testimonial Slider

Cross-Site Request Forgery (CSRF) vulnerability in Analytify plugin <= 4.2.2 on WordPress.

Homepage | Documentation | Support | Demo | Premium Version

**Google Analytics Dashboard**

**Google Analytics Dashboard Plugin for WordPress** – by Analytify makes **Google Analytics** simple for everyone using WordPress. We know how important it is to keep track of website analytics.

Analytify allows you to present the statistics from Google Analytics in a beautiful and useful manner. The integration is super simple and does not require the help of a developer to set up the integration. Once you integrate Google Analytics in WordPress using Analytify, you will be able to view the dashboard both at the front end and the backend.

Unlike other WordPress analytics plugins, Analytify brings a lot of actionable data in a single view at the dashboard. The Free version will let you view statistics like Visitors, Page views, New vs Returning Visitors, Top Pages, Geographic data, and much more.

The best part about Analytify is that it lets you view page-level statistics like views, users, bounce rate, average time on the page while being logged in the Admin panel of your WordPress website.

The premium version of this WordPress plugin is built to leverage the power of website analytics to let you know how people find and use your website.

Now you can get Google Analytics Dashboard inside your WordPress Dashboard with just a few clicks. Our goal at Analytify is pretty simple, to make data Analytics fun In WordPress.

Analytify is one of the few WordPress analytics plugins, which is the Google Analytics Technology Partner. This means our plugin is carefully tested and vetted to make sure you get the kind of support you need to be successful.

**Analytify 4.0 is here! Discover Google Analytics Like Never Before! Must check those stunning Screenshots!**

**ANALYTIFY PRO VERSION:**

> This is the free version of Analytify, there is a Premium version that comes with basic plus advanced features to help you get Google Analytics in WordPress. The Pro version is more easy to install, and shows **Real-Time Stats**, **Campaign Stats**, **ShortCodes**, **Front-end Stats** and more reports in backend and front-end. Also the premium version has better ecommerce tracking (Buy Add-ons with premium), and campaigns management. Get the affordable Premium Version from analytify.io . Bundle price is also available with Addons.

**ANALYTIFY IS A MULTILINGUAL PLUGIN, AVAILABLE IN THE FOLLOWING LANGUAGES**

The plugin is fully available in French, Turkish and Hungarian languages. However Dutch, German and Russian are just about to be fully translated. We are working hard to make sure the plugin is fully available in all the mentioned languages.

*   French 100%
*   Turkish 100%
*   Hungarian 100%
*   Dutch 96%
*   German 96%
*   Russian 82%
*   Norwegian 79%
*   Spanish 50%

> 100% Multilingual, Translatable and WPML Compatible

**INSTALLATION PROCESS OF ANALYTIFY WORDPRESS ANALYTICS PLUGIN**

Connect your WordPress site with Google Analytics with 1-Click Authentication process and It add Google Analytics tracking code to your WordPress website without the help of a developer.

> It is highly recommended by Google Analytics Team to use your own Custom API keys. You need to create a Project in Google Console.  
> Here is a short Video guide to get your own ClientID, Client Secret and Redirect URL. Add these API Keys in Advanced Tab before connecting Analytify with Google Analytics.

**TOP FEATURES OF THIS GOOGLE ANALYTICS PLUGIN FOR WORDPRESS**

Enhanced eCommerce Google analytics Tracking Add-ons for WooCommerce

Ecommerce tracking is a tricky process and requires the time and help of a developer to properly set up events and tracking. Analytify allows solid integration with WooCommerce to ensure you do not miss out on important eCommerce data of your business. It allows you to track product clicks, impressions, add to cart clicks, product performance, and much more right in your WordPress dashboard. The report also generates key insights on following factors:

*   Average Order Value
*   Transaction Revenues
*   Total Transactions
*   Products removed from the cart

Enhanced eCommerce Tracking for Easy Digital Downloads

Analytify’s addon for Easy Digital Downloads, lets you track digital sales, transactions, and revenue. We have made sure to sync the addon with Google Analytics for Easy Digital Downloads so that you can keep a close eye on the entire shopping behavior funnel of your website.

Geographical Data

The geographic data in the analytics report presents a beautiful visualization with the list of every country and city bringing traffic to your website. The low to high scale on the map makes it easy to identify the top traffic countries. You can easily identify those countries by hovering the mouse over the map.

Social Media Statistics in WordPress

Social media is a powerful source of traffic, and our plugin lets you know the effectiveness of your social media efforts inside your WordPress dashboard.

Real-Time Reporting

You must have seen real-time data in Google Analytics. But that nifty feature can be shown in your WordPress dashboard by connecting your WordPress site with Analytify.

Helps with Search Engine Optimization

Analytify lets you see traffic data for individual blog posts and pages, this keeps you aware of your top-performing content and allows you to take actionable steps.

Automated Email Reports

If you are an agency, or a business owner with multiple websites then our automated email reporting will come very handy for you. You can send individual post stats directly to your client by simply clicking “Send Email” within the dashboard.

Google Analytics System Stats Report

In the Analytify plugin, users can also view System stats report that includes how many visitors are coming from which platforms which include Operating systems, Browsers, and Mobile devices statistics.

Google Analytics Report for Goals

In the Analytify dashboard, you can also view your goals report that includes Goal Completions, Goals Value, Goals Conversion rate, Page per session, and Pages. The dashboard is further extended to show traffic sources and the goal completion from those sources.

Frontend Tracking Reports ShortCodes

If you want to show your stats to your user on the frontend side of your website or any post, you can easily do that. As Analytify provides you this amazing option by using shortcodes you can integrate tracking on your post or page for your users of visitors by adding shortcodes.

**GDPR Compatible Plugins**

*   CookieYes
*   Cookie Notice & Compliance.

**OTHER FEATURES YOU CAN GET BY CONNECTING YOUR SITE WITH GOOGLE ANALYTICS PLUGIN FOR WORDPRESS**

*   List of top Referrers Browsers
*   List of top Referrers
*   Mobile device Statistics
*   See What’s happening when users come to your site (Bounce rate of top pages)
*   It can be easily customizable with CSS, you can give it any shape you want.
*   You can extend it to any level. Usage of API’s are very easy to work with.
*   General Statistics (Sessions, Users, Bounce rate, Average time on site, Average pages, Pageviews, New/Returning Visitors)
*   How people are finding you (TOP KEYWORDS)
*   \[New\] Dashboard dropdown menu now remembers your last selection of time period.

PREMIUM FEATURES

*   Campaigns Statistics
*   Events Tracking
*   Google AMP
*   Google Optimize
*   Forms Tracking
*   Custom Dimensions
*   Use ShortCodes in Widgets
*   Google Analytics Stats (Full) under the single posts,pages & Custom Post Types as a block in wp-admin
*   ShortCodes (Simple and Advanced) for Custom Statistics of your own choice

WooCommerce Enhanced eCommerce tracking and report dashboard right inside your WordPress is now available. Take a look.

Following are the important add-ons which empower you to set up Google Analytics like a boss. It really helps your clients, online stores, etc.

*   Google Analytics Goals Dashboard
*   Google Analytics eCommerce Tracking for WooCommerce
*   Google Analytics eCommerce Tracking for Easy Digital Downloads
*   Automated Email Notifications
*   Google Analytics Campaigns Tracking
*   \[Free\] Google Analytics Dashboard Widget

FOLLOWING IS A COMPLETE HIERARCHY STRUCTURE OF ANALYTIFY PRODUCTS SUITE

*   Analytify Core (Free and Required for all add-ons)
    *   Dashboard widget (Free) Google Analytics Widget in your WordPress Dashboard.
    *   Analytify Pro (Paid)
        *   Campaign Tracking (Paid)
        *   Email Notifications (Paid)
        *   Google Analytics Goals Tracking and Dashboard (Paid)
        *   Google Analytics Forms Tracking and Dashboard (Paid)
        *   Google Analytics Authors Tracking and Dashboard (Paid)
        *   Enhanced Ecommerce Google Analytics Tracking for WooCommerce (Paid)
        *   Enhanced Ecommerce Google Analytics Tracking for Easy Digital Downloads (Paid)

It is highly recommended by Google Analytics Team to use your own Custom API keys. You need to create a Project in Google Console.

Here is a short Video guide or a tutorial to get your own ClientID, Client Secret and Redirect URL. Add these API Keys in Advanced Tab before connecting Analytify with Google Analytics.

> This Google analytics plugin is also available on github and ready to take bugs and pull requests. For Support, you can buy the **PRO version**, this will give access to premium updates, support and features.

**Notes**

Analytify is the best Google Analytics plugin for WordPress. We make Google Analytics look EASY. You know all about Google Analytics and love the data it provides, but wouldn’t it be nice if there is a tool to make managing all of that complex information simpler?

You’re in luck.

Google Analytics Was Never This Fun In WordPress before.

Following is a list of Testimonials you must read them once.

Testimonial # 1

**Great way to understand your audience**

I’ve been using the Pro version for quite a while. I really love how it gives me in-depth information about each individual post. That kind of info is hard to navigate to in Google Analytics even if you’re relatively familiar with it already. I discovered all kinds of new things about how people land on my site and how they engage with it just by activating the plugin and looking at the information it provides in the Dashboard and on individual posts.

The author is also an official Google analytics Partner, which I think speaks volumes. Well done all around, highly recommended!

Testimonial # 2

**Best Google Analytics Plugin**

This is something that clients really love as they of course want to see traffic to their site. However many do not want to log into google analytics and work their way through its rather complicated reporting modules. This gives all the headline stuff and more. What’s really neat is that it does it for every single page as well. So you can really see what’s going on for a particular post. So a google search for X led to this page. It also has great realtime reporting for the paid version. I had one small issue and the developer responded and addressed it immediately. Very impressed. It’s become a default plugin.

Testimonial # 3

**Excellent Integrations with Google Analytics**

Many of my clients don’t want to view analytics outside their dashboard. This plugin integrates GA beautifully within the WordPress admin panel. I suggest you give it a spin. The developers are also very nice and dedicated to the plugin, which goes a long way.

Testimonial # 4

**Outstanding support and product**

Besides thinking the plugin is wonderful, I am equally impressed with the support team. I had issues and they emailed back and forth to resolve my issues and even update the plugin for me. I highly recommend this plugin which has been very beneficial to my analytics, but just as important, I appreciate the support in resolving my issue in a very timely manner.

You may buy the premium version to support the development.

https://analytify.io/details

CVE-2022-38137: Analytify – Google Analytics Dashboard For WordPress

Cross-Site Request Forgery (CSRF) vulnerability in Advanced Order Export For WooCommerce plugin <= 3.3.2 on WordPress leading to export file download.

 Verified

 Fixed

**4.3**

CVSS 3.1 score Medium severity

Report  

Monitoring Not reported to be exploited

Vulnerable versions

<= 3.3.2

PSID 

a89cac7d4579

Classification 

Cross Site Request Forgery (CSRF)

OWASP Top 10 

A5: Broken Access Control

Publicly disclosed

2022-10-20

**Details**

Cross-Site Request Forgery (CSRF) vulnerability leading to export file download discovered by Lana Codes (Patchstack Alliance) in WordPress Advanced Order Export For WooCommerce plugin (versions <= 3.3.2).

**Solution**

Update the WordPress Advanced Order Export For WooCommerce plugin to the latest available version (at least 3.3.3).

**References**

Tag

#csrf