WordPress Plugin Vulnerabilities

Google Map Shortcode <= 3.1.2 - Settings Update via CSRF

Description

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Affects Plugins

Plugin icon
google-map-shortcode
No known fix

References

CVE
CVE-2023-38396

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
thiennv
Verified
No
WPVDB ID
70830da6-cc54-4ee9-9250-4e432167c176

Timeline

Publicly Published
2023-07-24 (about 2 years ago)
Added
2023-10-11 (about 2 years ago)
Last Updated
2023-10-11 (about 2 years ago)

Other

Published
Title
Published
2025-04-09
Title
WP shop <= 2.6.1 - Arbitrary File Upload via CSRF
Published
2025-03-27
Title
Christmas Panda < 1.1.0 - Cross-Site Request Forgery
Published
2023-06-19
Title
WP Sticky Social 1.0.1 - Stored XSS via CSRF
Published
2024-02-05
Title
Link Library < 7.6 - Cross-Site Request Forgery via action_admin_init
Published
2024-11-23
Title
iPhone Webclip Manager <= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting