CVE-2013-6797

🗓️ 15 Nov 2013 20:00:00Reported by mitreType

cve

cve🔗 web.nvd.nist.gov👁 35 Views🌐 WEB

Cross-site request forgery (CSRF) vulnerability in Blue Wrench Video Widget plugi

Reporter	Title	Published	Views	Family All 8
Circl	CVE-2013-6797	23 Nov 201300:00	–	circl
Cvelist	CVE-2013-6797	15 Nov 201320:00	–	cvelist
EUVD	EUVD-2013-6599	7 Oct 202500:30	–	euvd
NVD	CVE-2013-6797	19 Nov 201304:50	–	nvd
Patchstack	WordPress Blue Wrench Video Widget Plugin - Cross Site Request Forgery	23 Nov 201300:00	–	patchstack
Prion	Cross site request forgery (csrf)	19 Nov 201304:50	–	prion
RedhatCVE	CVE-2013-6797	7 Jan 202609:53	–	redhatcve
WPVulnDB	Blue Wrench Video Widget 1.0.2 - Multiple Stored Cross-Site Scripting (XSS)	1 Aug 201410:59	–	wpvulndb

NVD

Node

sunil_nanda blue_wrench_video_widgetRange≤1.0.5-wordpress

OR

sunil_nanda blue_wrench_video_widgetMatch1.0.0-wordpress

OR

sunil_nanda blue_wrench_video_widgetMatch1.0.1-wordpress

OR

sunil_nanda blue_wrench_video_widgetMatch1.0.2-wordpress

OR

sunil_nanda blue_wrench_video_widgetMatch1.0.3-wordpress

OR

sunil_nanda blue_wrench_video_widgetMatch1.0.4-wordpress

Source	Link
osvdb	www.osvdb.org/98923
securityundefined	www.securityundefined.com/wordpress-plugin-blue-wrench-video-widget-csrf-persistent-xss-0day-disclosure/
wordpress	www.wordpress.org/plugins/blue-wrench-videos-widget/changelog
osvdb	www.osvdb.org/98922

Parameter	Position	Path	Description	CWE
bw_url	query param	wp-admin/admin.php	CSRF in Blue Wrench Video Widget plugin allows hijacking admin authentication via embedded URL using bw_url parameter on the bw-videos page to wp-admin/admin.php	CWE-352

29 Apr 2026 01:13Current

7.4High risk

Vulners AI Score7.4

CVSS 26.8

EPSS0.00344

cve-2013-6797 csrf vulnerability blue wrench video widget wordpress hijack authentication administrators remote attackers bw_url parameter wp-admin/admin.php javascript