WordPress Plugin Vulnerabilities

WP Tabs < 2.1.15 - Multiple CSRF

Description

The plugin does not have proper CSRF checks in some places, for example when importing shortcodes, which could allow attackers to make logged in admins perform unwanted actions via CSRF attacks

Affects Plugins

Plugin icon
wp-expand-tabs-free
Fixed in 2.1.15

References

CVE
CVE-2023-25065

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
Lana Codes
Verified
No
WPVDB ID
cca0628e-3444-4773-9ac7-6471bcf002ac

Timeline

Publicly Published
2023-01-06 (about 3 years ago)
Added
2023-02-14 (about 3 years ago)
Last Updated
2023-02-14 (about 3 years ago)

Other

Published
Title
Published
2025-01-16
Title
RSS News Scroller <= 2.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2024-08-22
Title
Blog Introduction <= 0.3.0 - Settings Update via CSRF
Published
2025-06-13
Title
Yougler Blogger Profile Page <= v1.01 - Cross-Site Request Forgery to Settings Update
Published
2021-06-14
Title
Woocommerce Stock Manager < 2.6.0 - CSRF to Arbitrary File Upload
Published
2025-11-03
Title
ViaAds < 2.1.3 - Cross-Site Request Forgery to API Key Update