WordPress Plugin Vulnerabilities

Journey Analytics < 1.0.13 - Unauthorised AJAX call via CSRF

Description

The plugin did not properly check for CSRF in some of its function, allowing attacker to make users do unwanted actions

Affects Plugins

Plugin icon
journey-analytics
Fixed in 1.0.13

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
WPScanTeam
Verified
Yes
WPVDB ID
b8c711d2-9524-47a7-b4a0-3e3ee6c502d1

Timeline

Publicly Published
2021-06-30 (about 4 years ago)
Added
2021-06-30 (about 4 years ago)
Last Updated
2021-06-30 (about 4 years ago)

Other

Published
Title
Published
2023-10-16
Title
Widgets for Google Reviews < 10.9.1 - Arbitrary Settings Update via CSRF
Published
2024-04-10
Title
NewsXpress < 1.0.8 - Cross-Site Request Forgery to Notice Dismissal
Published
2025-12-31
Title
Recent Posts From Each Category <= 1.4 - Cross-Site Request Forgery
Published
2025-02-03
Title
On Page SEO + Whatsapp Chat Button < 2.0.1 - Stored XSS via CSRF
Published
2021-10-04
Title
BP Better Messages < 1.9.9.41 - Multiple CSRF