VDB

CVE-2023-3254

CVE-2023-3254 PUBLISHED CVSS 4.300000190734863 MEDIUM

The Widgets for Google Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.9. This is due to missing or incorrect nonce validation within setup_no_reg_header.php. This makes it possible for unauthenticated attackers to reset plugin settings and remove reviews via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

EPSS 0.20% · 9.7th percentile

Risk Scores

CVSS 3.1
4.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
EPSS Score
0.20%
9.7th percentile

Affected Products

VendorProductVersions
trustindexWidgets for Google Reviews*, 0
trustedindexwidgets_for_google_reviews0, 0

Timeline

  • Oct 18, 2023 EPSS Score
  • Oct 18, 2023 CVE Published
  • Oct 18, 2023 PoC Published
  • Nov 18, 2023 EPSS Score
  • Dec 20, 2023 EPSS Score
  • Jan 20, 2024 EPSS Score
  • Feb 21, 2024 EPSS Score
  • Mar 23, 2024 EPSS Score
  • Apr 23, 2024 EPSS Score
  • May 25, 2024 EPSS Score
  • Jun 25, 2024 EPSS Score
  • Jul 26, 2024 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›