The Floating Social Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the floating_social_buttons_option() function. This makes it possible for unauthenticated attackers to update the plugins settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Metrics
Affected Vendors & Products
References
History
Tue, 20 Aug 2024 14:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Varniinfotech
Varniinfotech floating Social Buttons |
|
Weaknesses | CWE-352 | |
CPEs | cpe:2.3:a:varniinfotech:floating_social_buttons:*:*:*:*:*:wordpress:*:* | |
Vendors & Products |
Varniinfotech
Varniinfotech floating Social Buttons |
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published: 2024-06-29T02:02:57.630Z
Updated: 2024-08-01T21:41:03.309Z
Reserved: 2024-06-28T12:56:16.511Z
Link: CVE-2024-6405
Vulnrichment
Updated: 2024-08-01T21:41:03.309Z
NVD
Status : Modified
Published: 2024-06-29T02:15:02.223
Modified: 2024-11-21T09:49:35.270
Link: CVE-2024-6405
Redhat
No data.