WordPress Plugin Vulnerabilities

Taggbox < 3.4 - Cross-Site Request Forgery

Description

The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on one of its functions. This makes it possible for unauthenticated attackers to invoke this function via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVE-2023-45763 appears to be associated to this vulnerability as well.

Affects Plugins

Plugin icon
taggbox-widget
Fixed in 3.4

References

CVE
CVE-2023-33214
URL
https://patchstack.com/database/vulnerability/taggbox-widget/wordpress-taggbox-ugc-galleries-social-media-widgets-user-reviews-analytics-plugin-2-9-cross-site-request-forgery-csrf-vulnerability

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Jonas Höbenreich
Verified
No
WPVDB ID
2729d7db-3524-4407-be8c-9d85aec3c048

Timeline

Publicly Published
2023-10-12 (about 2 years ago)
Added
2023-11-23 (about 2 years ago)
Last Updated
2026-08-25 (about 28 days ago)

Other

Published
Title
Published
2022-05-30
Title
Multi-page Toolkit <= 2.6 - Arbitrary Settings Update to Stored XSS via CSRF
Published
2026-04-09
Title
Aruba HiSpeed Cache < 3.0.5 - Cross-Site Request Forgery to Plugin Settings Reset
Published
2024-06-20
Title
Ali2Woo Lite < 3.4.4 - PHP Object Injection via CSRF
Published
2024-08-23
Title
Favicon Generator < 2.1 - Arbitrary File Deletion via CSRF
Published
2023-11-27
Title
teachPress < 9.0.5 - Cross-Site Request Forgery