WordPress Plugin Vulnerabilities
Popularis Extra <= 1.2.10 - Cross-Site Request Forgery
Description
The Popularis Extra plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.10. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affects Plugins
No known fix References
Classification
Type
CSRF
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Trương Hữu Phúc (truonghuuphuc)
Verified
No
WPVDB ID
Timeline
Publicly Published
2026-01-28 (about 8 months ago)
Added
2026-02-26 (about 7 months ago)
Last Updated
2026-02-26 (about 7 months ago)
