GCVE - cpe:2.3:a:delower186:wp_to_do:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:delower186:wp_to_do:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Delower186 (`2c8febb2-d36c-5c1f-92b5-cc52084b9576`)
Product	Wp To Do (`b76f5049-1482-54b3-916d-ebdfb9d18c9d`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-3947`	vulnerable	2026-06-08 06:43:51.952157	WP To Do <= 1.3.0 - Cross-Site Request Forgery via wptodo_settings MEDIUM (4.3) The WP To Do plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0. This is due to missing or incorrect nonce validation on the wptodo_settings() function. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Published: 2024-05-30T04:31:56.647Z Updated: 2026-04-08T17:19:50.180Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/c132cfc1-03b3-4616-9a66-871e88c857cb?source=cve https://plugins.trac.wordpress.org/browser/wp-todo/trunk/inc/Base/Model.php#L304 https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3345087%40wp-todo&new=3345087%40wp-todo&sfp_email=&sfph_mail=	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-3946`	vulnerable	2026-06-08 06:43:51.951811	WP To Do <= 1.3.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Settings MEDIUM (4.4) The WP To Do plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Published: 2024-05-30T04:31:57.099Z Updated: 2026-04-08T17:28:17.764Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/de648bea-35c5-4611-aa2f-79e37a0299bb?source=cve https://plugins.trac.wordpress.org/browser/wp-todo/trunk/inc/Base/Model.php#L304 https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3345087%40wp-todo&new=3345087%40wp-todo&sfp_email=&sfph_mail=	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-3945`	vulnerable	2026-06-08 06:43:51.951439	WP To Do <= 1.3.0 - Cross-Site Request Forgery via wptodo_manage() MEDIUM (4.3) The WP To Do plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0. This is due to missing or incorrect nonce validation on the wptodo_manage() function. This makes it possible for unauthenticated attackers to add new todo items via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Published: 2024-05-30T04:31:55.582Z Updated: 2026-04-08T16:58:36.325Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/69475bec-1f27-4793-8697-1132ac701c62?source=cve https://plugins.trac.wordpress.org/browser/wp-todo/trunk/inc/Base/Model.php#L273 https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3345087%40wp-todo&new=3345087%40wp-todo&sfp_email=&sfph_mail=	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-3944`	vulnerable	2026-06-08 06:43:51.950945	WP To Do <= 1.3.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Task Comments MEDIUM (4.4) The WP To Do plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Published: 2024-08-29T05:30:56.826Z Updated: 2026-04-08T17:16:38.895Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/b36b9b8a-41b0-4b57-92c7-5acebe2b0bae?source=cve https://plugins.trac.wordpress.org/browser/wp-todo/trunk/inc/Base/Model.php#L225 https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3345087%40wp-todo&new=3345087%40wp-todo&sfp_email=&sfph_mail=	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-3943`	vulnerable	2026-06-08 06:43:51.949811	WP To Do <= 1.3.0 - Cross-Site Request Forgery via wptodo_addcomment MEDIUM (4.3) The WP To Do plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.0. This is due to missing or incorrect nonce validation on the wptodo_addcomment function. This makes it possible for unauthenticated attackers to add comments to to do items via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Published: 2024-05-30T04:31:55.047Z Updated: 2026-04-08T16:48:23.864Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/406f6bd7-f57f-4725-a36f-9846ac04f945?source=cve https://plugins.trac.wordpress.org/browser/wp-todo/trunk/inc/Base/Model.php#L225 https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3345087%40wp-todo&new=3345087%40wp-todo&sfp_email=&sfph_mail=	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.