WordPress Plugin Vulnerabilities

Perelink Pro <= 2.1.4 - Settings Update via CSRF

Description

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Affects Plugins

Plugin icon
perelink
No known fix

References

CVE
CVE-2023-37990

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Skalucy
Verified
No
WPVDB ID
5ccf1408-ad05-484a-9ec9-afd8131ed46b

Timeline

Publicly Published
2023-07-24 (about 2 years ago)
Added
2023-10-12 (about 2 years ago)
Last Updated
2023-10-12 (about 2 years ago)

Other

Published
Title
Published
2025-07-30
Title
Photo Engine < 6.4.4 - Cross-Site Request Forgery
Published
2025-01-16
Title
More Link Modifier <= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2024-04-12
Title
Libsyn Publisher Hub <= 1.4.4 - Cross-Site Request Forgery
Published
2025-02-24
Title
JPG, PNG Compression and Optimization <= 1.7.35 - Cross-Site Request Forgery
Published
2023-03-16
Title
Hotel Booking Lite < 4.7.0 - Settings Update via CSRF