WordPress Plugin Vulnerabilities

Comments Ratings < 1.1.7 - Cross-Site Request Forgery

Description

The plugin does not properly validate requests use nonces, leading to a potential Cross-Site Request Forgery vulnerability.

Affects Plugins

Plugin icon
comments-ratings
Fixed in 1.1.7

References

CVE
CVE-2023-23704
URL
https://patchstack.com/database/vulnerability/comments-ratings/wordpress-comments-ratings-plugin-1-1-6-cross-site-request-forgery-csrf-vulnerability

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
yuyudhn
Verified
No
WPVDB ID
19ec9c42-9c32-4c9a-9925-eac439a3c976

Timeline

Publicly Published
2023-04-07 (about 2 years ago)
Added
2023-07-11 (about 2 years ago)
Last Updated
2023-07-11 (about 2 years ago)

Other

Published
Title
Published
2024-04-25
Title
Newsletter Popup <= 1.2 - Subscriber Deletion via CSRF
Published
2021-08-25
Title
Nested Pages < 3.1.16 - CSRF to Arbitrary Post Deletion and Modification
Published
2025-04-09
Title
WordPress Spam Blocker <= 2.0.5 - Stored XSS via CSRF
Published
2024-04-11
Title
WP Migration Plugin DB & Files – WP Synchro < 1.11.3 - Cross-Site Request Forgery
Published
2026-01-19
Title
Newsletter – Send awesome emails from WordPress < 9.1.1 - Cross-Site Request Forgery to Newsletter Unsubscription