WordPress Plugin Vulnerabilities

CSRF Bypass in Multiple Plugins

Description

Multiple plugins are affected by CSRF bypass as they do not properly check for the nonce due to a logic flaw. This could allow attackers to make logged in users do unwanted actions

Affects Plugins

Plugin icon
slider-hero
Fixed in 8.2.1
Plugin icon
amministrazione-trasparente
Fixed in 7.1.1
Plugin icon
free-comments-for-wordpress-vuukle
Fixed in 4.0
Plugin icon
wp-easy-pay
Fixed in 3.2.1
Plugin icon
woo-abandoned-cart-recovery
Fixed in 1.0.4.1
Plugin icon
locations
Fixed in 4.0

References

CVE
CVE-2021-4424
CVE
CVE-2021-4427
URL
https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
Jerome Bruandet (nintechnet)
Verified
Yes
WPVDB ID
20851a18-8309-4405-b85c-acaa047effa7

Timeline

Publicly Published
2021-07-05 (about 4 years ago)
Added
2021-07-05 (about 4 years ago)
Last Updated
2023-07-12 (about 2 years ago)

Other

Published
Title
Published
2024-09-24
Title
NiceJob < 3.6.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2024-12-12
Title
Category of Posts <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2025-01-16
Title
Custom Post <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2025-05-07
Title
EasyMe Connect <= 3.0.3 - Cross-Site Request Forgery
Published
2023-02-28
Title
Real Estate 7 < 3.3.5 - Reflected XSS