Lws Sms Vulnerabilities

The LWS SMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request gran...

CVSS:

4.3

Affected:

up to 2.4.1

Fix:

No patched version reported

Disclosed:

Mar 28, 2025

CVE-2025-31457 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Aurélien LWS LWS SMS allows Cross Site Request Forgery. This issue affects LWS SMS: from n/a through 2.4.1.

Affected:

up to 2.4.1

Fix:

No patched version reported

Disclosed:

Mar 28, 2025

CVE-2025-31457 on NVD →

Several LWS Plugins for WordPress are vulnerable to authorization bypass due to making admin settings pages available to users with read access (LWS Affiliation in versions up to, and including, 2.1; LWS Optimize in versions up to, and including, 1.5; LWS Tools in versions up to, and including, 2.1; LWS Cleaner in vers...

CVSS:

8.8

Affected:

up to 2.1

Fixed in:

2.1.5

Disclosed:

Dec 12, 2022

Several LWS Plugins for WordPress are vulnerable to authorization bypass due to making admin settings pages available to users with read access (LWS Affiliation in versions up to, and including, 2.1; LWS Optimize in versions up to, and including, 1.5; LWS Tools in versions up to, and including, 2.1; LWS Cleaner in vers...

Affected:

up to 2.1.5

Fixed in:

2.1.5

Disclosed:

Dec 12, 2022