WordPress Plugin Vulnerabilities

Table Block by RioVizual < 2.3.2 - Cross-Site Request Forgery

Description

The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action granted they can trick a site administrator into performing an action such as clicking on a link.

Affects Plugins

Plugin icon
riovizual
Fixed in 2.3.2

References

CVE
CVE-2025-32278
URL
https://patchstack.com/database/wordpress/plugin/riovizual/vulnerability/wordpress-table-block-by-riovizual-plugin-2-1-7-cross-site-request-forgery-csrf-vulnerability

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Kévin Mosbahi (Mika)
Verified
No
WPVDB ID
88c3f627-625c-49c7-8c12-b30f06b2b5b8

Timeline

Publicly Published
2025-04-04 (about 1 year ago)
Added
2025-04-22 (about 1 year ago)
Last Updated
2025-08-11 (about 1 year ago)

Other

Published
Title
Published
2026-07-28
Title
FuseWP < 1.1.25.2 - Cross-Site Request Forgery to Sync Rule Status Toggle
Published
2023-03-03
Title
About Me 3000 widget <= 2.2.6 - CSRF
Published
2025-05-16
Title
Import Export For WooCommerce <= 1.6.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2022-04-25
Title
Tracked Tweets <= 0.2.9 - Stored Cross-Site Scripting via CSRF
Published
2025-01-16
Title
my-related-posts <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting