WordPress Plugin Vulnerabilities

PixelYourSite < 10.0.2 - Settings Update via CSRF

Description

The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on the init() function. This makes it possible for unauthenticated attackers to modify settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Affects Plugins

Plugin icon
pixelyoursite
Fixed in 10.0.2

References

CVE
CVE-2025-22300
URL
https://patchstack.com/database/wordpress/plugin/pixelyoursite/vulnerability/wordpress-pixelyoursite-plugin-10-0-1-2-cross-site-request-forgery-csrf-vulnerability

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Dhabaleshwar Das
Verified
No
WPVDB ID
e14a7dfc-5a97-4fb1-911e-e819270352de

Timeline

Publicly Published
2025-01-06 (about 1 year ago)
Added
2025-01-15 (about 1 year ago)
Last Updated
2025-01-15 (about 1 year ago)

Other

Published
Title
Published
2025-01-16
Title
DF Draggable <= 1.13.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2023-11-07
Title
Droit Dark Mode <= 1.1.2 - Cross-Site Request Forgery
Published
2014-08-01
Title
Better Search < 1.3 - admin.inc.php Setting Manipulation CSRF
Published
2024-11-01
Title
Webriti Custom Login <= 0.3 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
Published
2024-09-30
Title
Copyscape Premium < 1.4.0 - Stored XSS via CSRF