WordPress Plugin Vulnerabilities

Classified Listing < 2.4.6 - Cross-Site Request Forgery

Description

The plugin does not adequately verify requests using nonces, leading to a potential Cross-Site Request Forgery vulnerability.

Affects Plugins

Plugin icon
classified-listing
Fixed in 2.4.6

References

CVE
CVE-2023-37387
URL
https://patchstack.com/database/vulnerability/classified-listing/wordpress-classified-listing-plugin-2-4-5-cross-site-request-forgery-csrf-leading-to-thumbnail-removal-vulnerability

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
Lana Codes
Verified
No
WPVDB ID
7fae8aa7-e389-46bb-ac67-48c8bea9811f

Timeline

Publicly Published
2023-07-05 (about 2 years ago)
Added
2023-07-18 (about 2 years ago)
Last Updated
2023-07-18 (about 2 years ago)

Other

Published
Title
Published
2017-07-25
Title
YouTube Embed <= 11.8.1 - Cross-Site Request Forgery (CSRF)
Published
2024-05-27
Title
Integration for Contact Form 7 and Constant Contact < 1.1.6 - CSRF
Published
2026-04-21
Title
mCatFilter <= 0.5.2 - Cross-Site Request Forgery via compute_post() Function
Published
2024-07-01
Title
Hestia < 3.1.3 - Cross-Site Request Forgery to Notice Dismissal
Published
2022-07-19
Title
E Unlocked - Student Result <= 1.0.4 - Arbitrary File Upload via CSRF