WordPress Plugin Vulnerabilities

WP Ultimate CSV Importer < 3.7.3 - Various CSRF

Description

The plugin does not have CSRF checks in various places, for example when updating its settings and importing CSV, which could allow attackers to make logged in admins perform such actions via CSRF attacks

Affects Plugins

Plugin icon
wp-ultimate-csv-importer
Fixed in 3.7.3

References

CVE
CVE-2015-10125

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Verified
No
WPVDB ID
2e6578c3-13df-4a87-b2d7-c36f4d798bca

Timeline

Publicly Published
2015-05-05 (about 11 years ago)
Added
2023-10-13 (about 2 years ago)
Last Updated
2023-10-13 (about 2 years ago)

Other

Published
Title
Published
2019-01-16
Title
Polylang <= 2.5 - CSRF in categories and media duplication
Published
2024-11-22
Title
yPHPlista <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2024-12-12
Title
CK and SyntaxHighlighter <= 3.4.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2023-09-05
Title
wpCentral <= 1.5.7 - Settings Update via CSRF
Published
2024-05-09
Title
Social Sharing Plugin – Social Warfare < 4.4.6 - Cross-Site Request Forgery