WordPress Plugin Vulnerabilities

SVGator – Add Animated SVG Easily < 1.2.5 - API Token Update/Deletion & Import Projects via CSRF

Description

The plugin does not have CSRF checks when updating and deleting API token as well as importing projects, which could allow attackers to make logged in admins perform such actions via CSRF attacks

Affects Plugins

Plugin icon
svgator
Fixed in 1.2.5

References

CVE
CVE-2023-48766
URL
https://patchstack.com/database/vulnerability/svgator/wordpress-svgator-add-animated-svg-easily-plugin-1-2-4-cross-site-request-forgery-csrf-vulnerability

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
6.5 (medium)

Miscellaneous

Original Researcher
Abdi Pranata
Verified
No
WPVDB ID
1b30af80-c15b-49c8-9630-2e8994a01b66

Timeline

Publicly Published
2023-11-28 (about 2 years ago)
Added
2023-12-08 (about 2 years ago)
Last Updated
2023-12-20 (about 2 years ago)

Other

Published
Title
Published
2024-10-30
Title
WPGlobus Translate Options <= 2.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2020-08-03
Title
Ajax Search Pro < 4.19 - Stored XSS via CSRF
Published
2024-07-05
Title
Master Slider < 3.10.0 - CSRF to slider deletion
Published
2023-10-03
Title
WP Forms Puzzle Captcha <= 4.1 - CSRF
Published
2021-06-08
Title
WP Prayer < 1.6.6 - Cross-Site Request Forgery