Enhanced Plugin Admin Vulnerabilities

[en] Cross-Site Request Forgery (CSRF) vulnerability in Marios Alexandrou Enhanced Plugin Admin plugin <= 1.16 versions.

Affected:

up to 1.17

Fixed in:

1.17

Disclosed:

Nov 12, 2023

CVE-2023-28618 on NVD →

The Enhanced Plugin Admin plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.16. This is due to missing or incorrect nonce validation on the epa_options_page function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request gr...

CVSS:

5.4

Affected:

up to 1.16

Fixed in:

1.17

Disclosed:

Mar 21, 2023

CVE-2023-28618 on NVD →

The Enhanced Admin Plugin for WordPress is vulnerable to Cross-Site Scripting via the 'REQUEST_URI' variable in versions before 1.16 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.

CVSS:

6.1

Affected:

up to 1.16

Fixed in:

1.16

Disclosed:

Apr 14, 2017

The Enhanced Admin Plugin for WordPress is vulnerable to Cross-Site Scripting via the 'REQUEST_URI' variable in versions before 1.16 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.

Affected:

up to 1.16

Fixed in:

1.16

Disclosed:

Apr 14, 2017

Affected:

up to 1.16

Fixed in:

1.16