WordPress Plugin Vulnerabilities

Open Graph Metabox <= 1.4.4 - CSRF

Description

The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks

Affects Plugins

Plugin icon
open-graph-metabox
No known fix

References

CVE
CVE-2023-46191
URL
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/open-graph-metabox/open-graph-metabox-144-cross-site-request-forgery
URL
https://patchstack.com/database/vulnerability/open-graph-metabox/wordpress-open-graph-metabox-plugin-1-4-4-cross-site-request-forgery-csrf-vulnerability

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
LEE SE HYOUNG
Verified
No
WPVDB ID
ce01fdc5-d8f1-4678-a4d0-190e2e75476b

Timeline

Publicly Published
2023-10-18 (about 2 years ago)
Added
2023-10-25 (about 2 years ago)
Last Updated
2023-10-25 (about 2 years ago)

Other

Published
Title
Published
2020-09-06
Title
EWWW Image Optimizer < 5.9 - Cross-Site Request Forgery
Published
2026-02-06
Title
TITLE ANIMATOR <= 1.0 - Cross-Site Request Forgery to Settings Update
Published
2024-04-11
Title
Modal Window < 5.3.10 - Modal Deletion via CSRF
Published
2024-12-12
Title
Aphorismus <= 1.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2023-10-06
Title
Simple SEO < 2.0.26 - Arbitrary Settings Update via CSRF