WordPress Plugin Vulnerabilities

Minify HTML <= 2.1.7 - Settings Update via CSRF

Description

The plugin does not have CSRF check when updating its settings, which could allow attackers to make logged in admins perform such action via a CSRF attack.

Affects Plugins

Plugin icon
minify-html-markup
Fixed in 2.1.8

References

CVE
CVE-2023-26014

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Mika, Rasi Afeef
Verified
No
WPVDB ID
33e98b98-df73-47f3-bcf5-7a85fddc85d1

Timeline

Publicly Published
2023-02-21 (about 3 years ago)
Added
2023-05-23 (about 2 years ago)
Last Updated
2023-05-23 (about 2 years ago)

Other

Published
Title
Published
2021-10-19
Title
Images to WebP < 1.9 - Multiple Cross Site Request Forgery (CSRF)
Published
2023-03-06
Title
clickfunnels <= 3.1.1 - Settings Update via CSRF
Published
2014-08-01
Title
Easy Media Gallery 1.2.25 - includes/emg-settings.php spg_add_admin Function Admin User Creation CSRF
Published
2025-05-16
Title
Seven Stars <= 1.4.4 - Cross-Site Request Forgery
Published
2025-02-19
Title
Ultimate Classified Listings < 1.6 - Cross-Site Request Forgery to Account Takeover