WordPress Plugin Vulnerabilities

Swatchly – WooCommerce Variation Swatches for Products < 1.2.1 - Cross-Site Request Forgery

Description

The plugin does not properly verify requests for nonces, making it susceptible to Cross-Site Request Forgery (CSRF) attacks.

Affects Plugins

Plugin icon
swatchly
Fixed in 1.2.1

References

CVE
CVE-2023-23792
URL
https://patchstack.com/database/vulnerability/swatchly/wordpress-swatchly-woocommerce-variation-swatches-for-products-product-attributes-image-swatch-color-swatches-label-swatches-plugin-1-1-9-cross-site-request-forgery-csrf-vulnerability

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Lana Codes
Verified
No
WPVDB ID
6c7db51a-941c-4094-a84e-5ad4eb6d63d2

Timeline

Publicly Published
2023-03-30 (about 2 years ago)
Added
2023-07-11 (about 2 years ago)
Last Updated
2023-07-11 (about 2 years ago)

Other

Published
Title
Published
2025-06-05
Title
Free WP Mail SMTP <= 1.0 - Cross-Site Request Forgery
Published
2024-12-06
Title
Poll Maker < 5.5.5 - Cross-Site Request Forgery to Poll Duplication
Published
2025-01-16
Title
Custom List Table Example <= 1.4.1 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
Published
2025-06-27
Title
MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet < 3.2.1 - Cross-Site Request Forgery to Settings Reset
Published
2025-03-24
Title
WP Odoo Form Integrator <= 1.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting