https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-12T06:26:51.435042+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2024-7501 CVE-2024-7501 — Download Plugins and Themes from Dashboard <= 1.8.7 - Cross-Site Request Forgery 2026-10-12T06:26:51.449049+00:00

Affected: wpcodefactory Download Plugins and Themes in ZIP from Dashboard

The Download Plugins and Themes in ZIP from Dashboard plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.7. This is due to missing or incorrect nonce validation on the download_theme() function. This makes it possible for unauthenticated attackers to download arbitrary themes from the website via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. In versions prior to 1.8.6 it was possible to download the entire sites files.