WordPress Plugin Vulnerabilities

Kv TinyMCE Editor Add Fonts <= 1.1 - Font List Update via CSRF

Description

The plugin does not have CSRF check when updating its font list, which could allow attackers to make logged in admins perform such action via a CSRF attack

Affects Plugins

Plugin icon
kv-tinymce-editor-fonts
No known fix

References

CVE
CVE-2023-44470

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Skalucy
Verified
No
WPVDB ID
e4ac9aca-4efe-463a-8680-35bc469df8e3

Timeline

Publicly Published
2023-09-28 (about 2 years ago)
Added
2023-10-11 (about 2 years ago)
Last Updated
2023-10-11 (about 2 years ago)

Other

Published
Title
Published
2024-11-28
Title
Out Of Stock Badge <= 1.3.1 - Cross-Site Request Forgery to Stored Cross-site Scripting
Published
2024-04-26
Title
Radio Station by netmix® – Manage and play your Show Schedule in WordPress! < 2.5.8 - Cross-Site Request Forgery to Notice Dismissal
Published
2025-04-16
Title
Integration for WooCommerce and QuickBooks < 1.3.2 - Cross-Site Request Forgery
Published
2025-06-27
Title
Virusdie < 1.1.4 - Cross-Site Request Forgery
Published
2025-11-10
Title
YSlider <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting