WordPress Plugin Vulnerabilities

Media Library Helper by Codexin < 1.3.0 - Cross-Site Request Forgery

Description

The plugin does not properly validate requests using nonces, making it susceptible to Cross-Site Request Forgery (CSRF) attacks.

Affects Plugins

Plugin icon
media-library-helper
Fixed in 1.3.0

References

CVE
CVE-2023-37386
URL
https://patchstack.com/database/vulnerability/media-library-helper/wordpress-media-library-helper-by-codexin-plugin-1-2-0-cross-site-request-forgery-csrf

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
Lana Codes
Verified
No
WPVDB ID
66c9102d-defa-47ba-8ff1-12a68e84572a

Timeline

Publicly Published
2023-07-05 (about 2 years ago)
Added
2023-07-18 (about 2 years ago)
Last Updated
2023-09-25 (about 2 years ago)

Other

Published
Title
Published
2025-01-24
Title
KBucket < 4.2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2023-05-25
Title
Product Gallery Slider for WooCommerce < 2.2.9 - Cross-Site Request Forgery (CSRF)
Published
2014-08-01
Title
WP-PostViews 1.62 - Setting Manipulation CSRF
Published
2024-10-15
Title
WP Content Copy Protection & No Right Click < 3.6.1 - Cross-Site Request Forgery
Published
2024-07-01
Title
pz-frontend-manager < 1.0.6 - CSRF change user profile picture