Multiple Cross-Site Request Forgery Vulnerabilities in WP-ViperGB Plugin for WordPress
CVE-2014-9460

Currently unrated

Key Information:

Vendor
Wordpress
Status
WP-vipergb
Vendor
CVE Published:
2 January 2015

Summary

The WP-ViperGB plugin for WordPress prior to version 1.3.11 is vulnerable to multiple cross-site request forgery (CSRF) attacks. These vulnerabilities allow unauthorized remote attackers to exploit the plugin and hijack administrator authentication. Attackers can manipulate plugin settings through unspecified vectors, enabling the potential for cross-site scripting (XSS) attacks via the 'vgb_page' or 'vgb_items_per_pg' parameters on the wp-vipergb page within the wp-admin/options-general.php interface. Proper validation and sanitization measures are essential to alleviate these security risks.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/99439
vdb-entryx_refsource_XF
https://wordpress.org/plugins/wp-vipergb/changelog/
x_refsource_CONFIRM
http://packetstormsecurity.com/files/129501/WordPress-WP-...
x_refsource_MISC

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.