WordPress Plugin Vulnerabilities

Taggbox <= 3.3 - Arbitrary Settings Update via CSRF

Description

The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks

Affects Plugins

Plugin icon
taggbox-widget
No known fix

References

CVE
CVE-2023-45763
URL
https://patchstack.com/database/vulnerability/taggbox-widget/wordpress-taggbox-ugc-galleries-social-media-widgets-user-reviews-analytics-plugin-2-9-cross-site-request-forgery-csrf-vulnerability

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Jonas Höbenreich
Verified
No
WPVDB ID
65791b1b-0f20-4727-8c42-afb46de189a1

Timeline

Publicly Published
2023-10-16 (about 2 years ago)
Added
2023-10-17 (about 2 years ago)
Last Updated
2024-03-20 (about 2 years ago)

Other

Published
Title
Published
2024-12-12
Title
ECT Social Share <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2024-12-02
Title
Maspik – Spam blacklist < 2.2.8 - Cross-Site Request Forgery to Plugin Settings Change
Published
2024-07-20
Title
Smartsupp < 3.7 - Cross-Site Request Forgery
Published
2024-04-11
Title
ELEX WooCommerce Dynamic Pricing and Discounts < 2.1.3 - Cross-Site Request Forgery
Published
2021-06-30
Title
Intimate Payments <= 1.3.1 - CSRF Bypass