Meks Easy Instagram Widget Vulnerabilities

[en] Cross-Site Request Forgery (CSRF) vulnerability in Meks Video Importer, Meks Time Ago, Meks ThemeForest Smart Widget, Meks Smart Author Widget, Meks Audio Player, Meks Easy Maps, Meks Easy Photo Feed Widget, Meks Simple Flickr Widget, Meks Easy Ads Widget, Meks Smart Social Widget plugins leading to dismiss or the...

Affected:

up to 1.2.8

Fixed in:

1.2.8

Disclosed:

Oct 3, 2023

CVE-2023-25989 on NVD →

The Meks Smart Social Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6. This is due to missing or incorrect nonce validation on the meks_remove_notification function. This makes it possible for unauthenticated attackers to dismiss admin notices via a forged r...

CVSS:

4.3

Affected:

up to 1.2.7

Fixed in:

1.2.8

Disclosed:

Jul 26, 2023

CVE-2023-25989 on NVD →

[en] The Meks Easy Photo Feed Widget WordPress plugin before 1.2.4 does not have capability and CSRF checks in the meks_save_business_selected_account AJAX action, available to any authenticated user, and does not escape some of the settings. As a result, any authenticated user, such as subscriber could update the plug...

Affected:

up to 1.2.4

Fixed in:

1.2.4

Disclosed:

Mar 14, 2022

CVE-2021-24958 on NVD →

The Meks Easy Photo Feed Widget WordPress plugin before 1.2.4 does not have capability and CSRF checks in the meks_save_business_selected_account AJAX action, available to any authenticated user, and does not escape some of the settings. As a result, any authenticated user, such as subscriber could update the plugin's...

CVSS:

5.4

Affected:

up to 1.2.4

Fixed in:

1.2.4

Disclosed:

Nov 10, 2021

CVE-2021-24958 on NVD →