Cross-Site Request Forgery Vulnerability in Smart Agenda Plugin for WordPress
CVE-2024-13348
6.1MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 14 January 2025
What is CVE-2024-13348?
The Smart Agenda – Prise de rendez-vous en ligne plugin for WordPress has a Cross-Site Request Forgery vulnerability due to inadequate nonce validation in the smartagenda_options_page_html() function. This allows unauthorized attackers to manipulate settings and inject malicious scripts through crafted requests if they can deceive an administrator into taking an action like clicking a compromised link. All versions up to and including 4.7 are affected, making it critical for site owners to adopt protective measures to mitigate risks.
Affected Version(s)
Smart Agenda – Prise de rendez-vous en ligne * <= 4.7