WordPress Plugin Vulnerabilities
Contest Gallery < 21.2.9 - Cross-Site Request Forgery
Description
The Contest Gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 21.2.8.4. This is due to missing or incorrect nonce validation in the prev10/prev10-admin/gallery/gallery.php file. This makes it possible for unauthenticated attackers to render galleries via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affects Plugins
Fixed in 21.2.9 References
Classification
Type
CSRF
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Dhabaleshwar Das
Verified
No
WPVDB ID
Timeline
Publicly Published
2024-02-05 (about 2 years ago)
Added
2024-02-08 (about 2 years ago)
Last Updated
2024-02-08 (about 2 years ago)
WPScan 