WordPress Plugin Vulnerabilities

WP Directory Kit < 1.2.0 - Cross-Site Request Forgery

Description

The plugin does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack

Affects Plugins

Plugin icon
wpdirectorykit
Fixed in 1.2.0

References

CVE
CVE-2023-2277

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
Lana Codes
Verified
No
WPVDB ID
68a49cf7-fd58-4a11-b3c5-2f87f371a7b5

Timeline

Publicly Published
2023-04-28 (about 3 years ago)
Added
2023-06-13 (about 2 years ago)
Last Updated
2023-06-13 (about 2 years ago)

Other

Published
Title
Published
2026-03-20
Title
login_register <= 1.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2026-04-07
Title
Simple Social Media Share Buttons – Social Sharing for Everyone < 6.2.1 - Cross-Site Request Forgery
Published
2023-10-31
Title
GiveWP < 2.33.4 - Cross-Site Request Forgery to Stripe Integration Deletion
Published
2016-10-28
Title
WP Database Backup <= 4.3.5 - Cross-Site Request Forgery (CSRF)
Published
2023-12-28
Title
Simple Job Board < 2.10.7 - Cross-Site Request Forgery