WordPress Plugin Vulnerabilities

Global Multisite Search <= 1.0.1 - CSRF Bypass

Description

The plugin does not properly check for CSRF in its wpgms_ajax_result_function AJAX action, allowing attacker to make logged in user call them it a CSRF attack

Affects Plugins

Plugin icon
global-multisite-search
No known fix

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
WPScanTeam
Verified
Yes
WPVDB ID
0eccb434-3cfc-476a-b154-478ca2a397d3

Timeline

Publicly Published
2021-06-30 (about 4 years ago)
Added
2021-06-30 (about 4 years ago)
Last Updated
2021-06-30 (about 4 years ago)

Other

Published
Title
Published
2025-04-17
Title
Bknewsticker <= 1.0.5 - Cross-Site Request Forgery
Published
2021-11-12
Title
Contact Form 7 Database Addon < 1.2.6.1 - Arbitrary Form Deletion via CSRF
Published
2026-02-13
Title
Grand Portfolio <= 3.3 - Cross-Site Request Forgery
Published
2018-01-09
Title
Download Manager <= 2.9.60 - Cross-Site Request Forgery (CSRF)
Published
2023-11-02
Title
Decorator - WooCommerce Email Customizer < 1.2.8 - Cross-Site Request Forgery