WordPress Plugin Vulnerabilities

Virusdie < 1.1.4 - Cross-Site Request Forgery

Description

The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action granted they can trick a site administrator into performing an action such as clicking on a link.

Affects Plugins

Plugin icon
virusdie
Fixed in 1.1.4

References

CVE
CVE-2025-53265
URL
https://patchstack.com/database/wordpress/plugin/virusdie/vulnerability/wordpress-virusdie-plugin-1-1-3-cross-site-request-forgery-csrf-vulnerability

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Nguyen Xuan Chien
Verified
No
WPVDB ID
07cc7731-b97d-4426-8433-e1a3c0116c2d

Timeline

Publicly Published
2025-06-27 (about 1 year ago)
Added
2025-07-02 (about 1 year ago)
Last Updated
2025-07-15 (about 1 year ago)

Other

Published
Title
Published
2025-09-22
Title
HORIZONTAL SLIDER <= 2.4 - Cross-Site Request Forgery
Published
2025-08-14
Title
Primer MyData for Woocommerce < 4.2.6 - Cross-Site Request Forgery
Published
2021-04-12
Title
Business Directory Plugin < 5.11.2 - Arbitrary Listing Export
Published
2025-06-06
Title
Min Max Step Quantity Limits Manager for WooCommerce < 5.1.1 - Cross-Site Request Forgery
Published
2022-10-25
Title
WPQA < 5.9 - Follow/Unfollow via CSRF