absikandar vulnerabilities and threats

The Frontend User Notes plugin for WordPress up to version 2.1.1 is vulnerable to a Cross-Site Request Forgery (CSRF) attack due to missing or incorrect nonce validation in the funp_ajax_modify_notes function. This vulnerability allows an attacker to trick a logged-in user, such as a site administrator, into performing unauthorized modifications to their own note content via a forged request. The attack is limited to notes owned by the victim user and cannot affect notes belonging to other users.

The Frontend User Notes plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.0 via the 'funp_ajax_modify_notes' AJAX endpoint due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify arbitrary notes that do not belong to them.