WordPress Plugin Vulnerabilities

Podlove Subscribe button < 1.3.9 - Multiple CSRF

Description

The plugin does not have CSRF checks in some places, which could allow attackers to make logged in admins perform unwanted actions (such as create/update/delete buttons, as well update/create formats) via CSRF attacks

Affects Plugins

Plugin icon
podlove-subscribe-button
Fixed in 1.3.9

References

CVE
CVE-2023-25481

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
yuyudhn
Verified
No
WPVDB ID
bbeb7d96-8938-4c5a-8460-b9c2464bcdf4

Timeline

Publicly Published
2023-02-15 (about 3 years ago)
Added
2023-04-25 (about 3 years ago)
Last Updated
2023-04-25 (about 3 years ago)

Other

Published
Title
Published
2022-05-26
Title
Image Slider by NextCode <= 1.1.2 - Multiple CSRF
Published
2023-01-20
Title
My Calendar < 3.4.4 - Cross-Site Request Forgery
Published
2025-01-24
Title
KBucket < 4.2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2025-12-04
Title
ContentStudio < 1.4.0 - Cross-Site Request Forgery to Settings Update
Published
2024-04-05
Title
Transcoder < 1.3.6 - Cross-Site Request Forgery