WordPress Plugin Vulnerabilities

Cool Timeline < 2.0.3 - Cross-Site Request Forgery

Description

The plugin does not protect the ctl_save function against CSRF attacks, allowing an unauthenticated attacker to save field icons by tricking a logged in administrator to submit a crafted request.

Affects Plugins

Plugin icon
cool-timeline
Fixed in 2.0.3

References

CVE
CVE-2020-36738
URL
https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Jerome Bruandet
Verified
No
WPVDB ID
1e6e5592-416b-4cff-b147-f3c7715cb821

Timeline

Publicly Published
2020-09-16 (about 5 years ago)
Added
2023-07-04 (about 2 years ago)
Last Updated
2023-07-04 (about 2 years ago)

Other

Published
Title
Published
2025-04-09
Title
Multiple Location Google Map <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2024-12-18
Title
EditionGuard for WooCommerce – eBook Sales with DRM <= 3.4.2 - Cross-Site Request Forgery to Privilege Escalation
Published
2023-01-27
Title
Conditional Shipping for WooCommerce < 2.3.2 - Ruleset Toggle via CSRF
Published
2023-07-04
Title
Menubar < 5.9 - Cross-Site Request Forgery
Published
2025-09-26
Title
Professional Contact Form <= 1.0.0 - Cross-Site Request Forgery to Test Email Sending