WordPress Plugin Vulnerabilities

CM On Demand Search And Replace < 1.3.1 - Multiple CSRF

Description

The plugin does not have CSRF checks when adding, updating and deleting replacements, which could allow attackers to make logged in admins perform such actions via CSRF attacks

Affects Plugins

Plugin icon
cm-on-demand-search-and-replace
Fixed in 1.3.1

References

CVE
CVE-2023-28749

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Abdi Pranata
Verified
No
WPVDB ID
a377f853-8bb5-4567-9657-c1ae94803ef1

Timeline

Publicly Published
2023-05-09 (about 3 years ago)
Added
2023-08-18 (about 2 years ago)
Last Updated
2023-08-18 (about 2 years ago)

Other

Published
Title
Published
2024-03-26
Title
RegistrationMagic < 5.3.1.0 - Cross-Site Request Forgery
Published
2025-08-25
Title
Newsletter subscription optin module <= 1.2.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2023-09-29
Title
CopyRightPro <= 2.1 - Settings Update via CSRF
Published
2025-04-09
Title
Site Table of Contents <= 0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2023-11-28
Title
AdFoxly – Ad Manager, AdSense Ads & Ads.txt <= 1.8.5 - Cross-Site Request Forgery