Cross-Site Request Forgery (CSRF) vulnerability in Meks Video Importer, Meks Time Ago, Meks ThemeForest Smart Widget, Meks Smart Author Widget, Meks Audio Player, Meks Easy Maps, Meks Easy Photo Feed Widget, Meks Simple Flickr Widget, Meks Easy Ads Widget, Meks Smart Social Widget plugins leading to dismiss or the popup.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00232.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Meks Meks Video Importer unaffected
Version Status Constraints
n/a affected ≤ 1.0.10
Meks Meks Time Ago unaffected
Version Status Constraints
n/a affected ≤ 1.1.6
Meks Meks ThemeForest Smart Widget unaffected
Version Status Constraints
n/a affected ≤ 1.4
Meks Meks Smart Author Widget unaffected
Version Status Constraints
n/a affected ≤ 1.1.3
Meks Meks Audio Player unaffected
Version Status Constraints
n/a affected ≤ 1.2
Meks Meks Easy Maps unaffected
Version Status Constraints
n/a affected ≤ 2.1.3
Meks Meks Easy Photo Feed Widget unaffected
Version Status Constraints
n/a affected ≤ 1.2.7
Meks Meks Simple Flickr Widget unaffected
Version Status Constraints
n/a affected ≤ 1.2
Meks Meks Easy Ads Widget unaffected
Version Status Constraints
n/a affected ≤ 2.0.7
Meks Meks Smart Social Widget unaffected
Version Status Constraints
n/a affected ≤ 1.6

Configuration 1 [-]

OR cpe:2.3:a:mekshq:meks_audio_player:*:*:*:*:*:wordpress:*:*
cpe:2.3:a:mekshq:meks_easy_ads_widget:*:*:*:*:*:wordpress:*:*
cpe:2.3:a:mekshq:meks_easy_maps:*:*:*:*:*:wordpress:*:*
cpe:2.3:a:mekshq:meks_easy_photo_feed_widget:*:*:*:*:*:wordpress:*:*
cpe:2.3:a:mekshq:meks_simple_flickr_widget:*:*:*:*:*:wordpress:*:*
cpe:2.3:a:mekshq:meks_smart_author_widget:*:*:*:*:*:wordpress:*:*
cpe:2.3:a:mekshq:meks_smart_social_widget:*:*:*:*:*:wordpress:*:*
cpe:2.3:a:mekshq:meks_themeforest_smart_widget:*:*:*:*:*:wordpress:*:*
cpe:2.3:a:mekshq:meks_time_ago:*:*:*:*:*:wordpress:*:*
cpe:2.3:a:mekshq:meks_video_importer:*:*:*:*:*:wordpress:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Mekshq Subscribe
Meks Audio Player Subscribe
Meks Easy Ads Widget Subscribe
Meks Easy Maps Subscribe
Meks Easy Photo Feed Widget Subscribe
Meks Simple Flickr Widget Subscribe
Meks Smart Author Widget Subscribe
Meks Smart Social Widget Subscribe
Meks Themeforest Smart Widget Subscribe
Meks Time Ago Subscribe
Meks Video Importer Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2023-29876 Cross-Site Request Forgery (CSRF) vulnerability in Meks Video Importer, Meks Time Ago, Meks ThemeForest Smart Widget, Meks Smart Author Widget, Meks Audio Player, Meks Easy Maps, Meks Easy Photo Feed Widget, Meks Simple Flickr Widget, Meks Easy Ads Widget, Meks Smart Social Widget plugins leading to dismiss or the popup.
Fixes

Solution

Update Meks Video Importer to 1.0.11 or a higher version.

Workaround

No workaround given by the vendor.

References
Link Providers
https://patchstack.com/database/vulnerability/meks-audio-player/wordpress-meks-audio-player-plugin-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve cve-icon cve-icon
https://patchstack.com/database/vulnerability/meks-easy-ads-widget/wordpress-meks-easy-ads-widget-plugin-2-0-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve cve-icon cve-icon
https://patchstack.com/database/vulnerability/meks-easy-instagram-widget/wordpress-meks-easy-photo-feed-widget-plugin-1-2-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve cve-icon cve-icon
https://patchstack.com/database/vulnerability/meks-easy-maps/wordpress-meks-easy-maps-plugin-2-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve cve-icon cve-icon
https://patchstack.com/database/vulnerability/meks-simple-flickr-widget/wordpress-meks-simple-flickr-widget-plugin-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve cve-icon cve-icon
https://patchstack.com/database/vulnerability/meks-smart-author-widget/wordpress-meks-smart-author-widget-plugin-1-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve cve-icon cve-icon
https://patchstack.com/database/vulnerability/meks-smart-social-widget/wordpress-meks-smart-social-widget-plugin-1-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve cve-icon cve-icon
https://patchstack.com/database/vulnerability/meks-themeforest-smart-widget/wordpress-meks-themeforest-smart-widget-plugin-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve cve-icon cve-icon
https://patchstack.com/database/vulnerability/meks-time-ago/wordpress-meks-time-ago-plugin-1-1-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve cve-icon cve-icon
https://patchstack.com/database/vulnerability/meks-video-importer/wordpress-meks-video-importer-plugin-1-0-10-cross-site-request-forgery-csrf-vulnerability?_s_id=cve cve-icon cve-icon
History

No history.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2024-08-02T14:48:57.427Z

Reserved: 2023-02-17T13:47:16.259Z

Link: CVE-2023-25989

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2023-10-03T12:15:10.243

Modified: 2024-11-21T07:50:34.650

Link: CVE-2023-25989

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses