WordPress Plugin Vulnerabilities

Reservation.Studio widget < 1.0.12 - Cross-Site Request Forgery

Description

The plugin does not properly validate requests use nonces, leading to a Cross-Site Request Forgery (CSRF) vulnerability.

Affects Plugins

Plugin icon
reservation-studio-widget
Fixed in 1.0.12

References

CVE
CVE-2023-25468
URL
https://patchstack.com/database/vulnerability/reservation-studio-widget/wordpress-reservation-studio-widget-plugin-1-0-9-cross-site-request-forgery-csrf-vulnerability

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Lokesh Dachepalli
Verified
No
WPVDB ID
69837f07-3b2a-49d5-8ba1-625309668e9b

Timeline

Publicly Published
2023-04-19 (about 3 years ago)
Added
2023-07-11 (about 2 years ago)
Last Updated
2023-07-27 (about 2 years ago)

Other

Published
Title
Published
2023-12-28
Title
Floating Button < 6.0.1 - Cross-Site Request Forgery via process_bulk_action
Published
2024-01-08
Title
LiveChat Elementor < 1.0.14 - Cross-Site Request Forgery
Published
2024-10-21
Title
Google Docs RSVP <= 2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2023-02-28
Title
OAuth Single Sign On - SSO (OAuth Client) Free < 6.24.2 - IdP Deletion via CSRF
Published
2025-09-05
Title
Purge Varnish Cache <= 2.6 - Cross-Site Request Forgery