WordPress Plugin Vulnerabilities

Material Design Icons for Page Builders < 1.4.3 - Settings Update via CSRF

Description

The plugin does not have CSRF check when updating its settings, which could allow attackers to make logged in admins perform such actions via a CSRF attack

Affects Plugins

Plugin icon
material-design-icons-for-elementor
Fixed in 1.4.3

References

CVE
CVE-2023-24382

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Lana Codes
Verified
No
WPVDB ID
23c85407-5938-490d-bb46-6bb440137b91

Timeline

Publicly Published
2023-01-24 (about 3 years ago)
Added
2023-02-14 (about 3 years ago)
Last Updated
2023-02-14 (about 3 years ago)

Other

Published
Title
Published
2025-06-05
Title
POEditor < 0.9.11 - Cross-Site Request Forgery
Published
2024-04-26
Title
MainWP Child Reports < 2.2 - Cross-Site Request Forgery
Published
2025-09-26
Title
Groovy Menu <= 1.4.3 - Cross-Site Request Forgery
Published
2023-05-29
Title
WOLF < 1.0.7.1 - Profile Creation via CSRF
Published
2026-01-30
Title
Popup Box < 6.1.2 - Cross-Site Request Forgery to Popup Status Change