WordPress Plugin Vulnerabilities

GiveWP < 2.25.3 - Cross-Site Request Forgery

Description

The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks.

Affects Plugins

Plugin icon
give
Fixed in 2.25.3

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Rafie Muhammad
Verified
No
WPVDB ID
db4b088d-2766-4857-b1d3-f3e9011b6ad9

Timeline

Publicly Published
2023-03-23 (about 3 years ago)
Added
2023-05-09 (about 3 years ago)
Last Updated
2023-05-09 (about 3 years ago)

Other

Published
Title
Published
2014-08-01
Title
XCloner - Backup and Restore < 3.1.1 - Multiple Actions CSRF
Published
2017-05-11
Title
Nelio Ab Testing < 4.6.4 - CSRF
Published
2023-10-31
Title
GiveWP < 2.33.4 - Cross-Site Request Forgery to plugin installation
Published
2024-04-10
Title
Link Whisper Free < 0.7.0
Published
2020-02-05
Title
WP Fastest Cache < 0.9.0.3 - Cross-Site Request Forgery (CSRF) Arbitrary File Deletion