Lucene search
PRIOn knowledge basePRION:CVE-2023-3254HistoryOct 18, 2023 - 5:15 a.m.
Cross site request forgery (csrf)
2023-10-1805:15:00
PRIOn knowledge base
www.prio-n.com
7
csrf
wordpress
plugin vulnerability
nonce validation
unauthenticated attackers
site administrator
forged request
nvd
The Widgets for Google Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.9. This is due to missing or incorrect nonce validation within setup_no_reg_header.php. This makes it possible for unauthenticated attackers to reset plugin settings and remove reviews via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
| CPE | Name | Operator | Version |
|---|---|---|---|
| widgets_for_google_reviews | le | 10.9 |
Related
cve
cve
CVE-2023-3254
2023-10-18 05:15:07
cvelist
cvelist
CVE-2023-3254
2023-10-18 04:32:21
nvd
nvd
CVE-2023-3254
2023-10-18 05:15:07
wpvulndb
wpvulndb
Widgets for Google Reviews < 10.9.1 - Arbitrary Settings Update via CSRF
2023-10-20 00:00:00
wordfence
wordfence