Vulnerabilities and security researches forhueman hueman

Jun 10, 2024

CVE, Research URL: CVE-2020-36753
Home page URL: Security reports for Hueman
Application: Hueman
Date: Oct 20, 2023
Research Description: The Hueman theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.6.3. This is due to missing or incorrect nonce validation on the save_meta_box() function. This makes it possible for unauthenticated attackers to save metabox data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected versions: max 3.6.4.
Status: vulnerable

Jun 11, 2024

CVE, Research URL: 039f4d913813d35d9492f3db9505b96c043e80ba
Home page URL: Security reports for Hueman
Application: Hueman
Date: Sep 16, 2020
Research Description: Hueman [hueman] < 3.6.4 WordPress Hueman theme <= 3.6.3 - Cross-Site Request Forgery (CSRF) vulnerability Cross-Site Request Forgery (CSRF) vulnerability found by Jerome Bruandet (NinTechNet) in WordPress Hueman theme (versions <= 3.6.3).
Affected versions: max 3.6.4.
Status: vulnerable

CVE, Research URL: -
Home page URL: Security reports for Hueman
Application: Hueman
Date: Jun 07, 2023
Research Description: Rejected reason: CVE split into individual CVE IDs for each software record.
Affected versions: max 3.6.2.
Status: vulnerable

Jun 22, 2024

CVE, Research URL: CVE-2024-35772
Home page URL: Security reports for Hueman
Application: Hueman
Date: Jun 21, 2024
Research Description: Cross-Site Request Forgery (CSRF) vulnerability in presscustomizr Hueman.This issue affects Hueman: from n/a through 3.7.24.
Affected versions: max 3.7.25.
Status: vulnerable

Jun 16, 2026

CVE, Research URL: e03420c55099714ac90da016761d318e5e1cb6db
Home page URL: Security reports for Hueman
Application: Hueman
Date: -
Research Description: Hueman [hueman] < 3.6.2 Various Affected Software (Various Versions) - Cross-Site Request Forgery Bypass Over 70 plugins and themes were vulnerable to Cross-Site Request Forgery due to improperly implemented nonce protection that could be bypassed.
Affected versions: max 3.6.2.
Status: vulnerable