Portfolio By Lisa Westlund Vulnerabilities

[en] Cross-site request forgery (CSRF) vulnerability in the Portfolio plugin before 1.05 for WordPress allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via a request to the instagram-portfolio page in wp-admin/options-general.php.

Affected:

up to 1.1

Fixed in:

1.1

Disclosed:

Aug 19, 2015

CVE-2015-6523 on NVD →

Cross-site request forgery (CSRF) vulnerability in the Portfolio plugin before 1.05 for WordPress allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via a request to the instagram-portfolio page in wp-admin/options-general.php.

CVSS:

6.3

Affected:

up to 1.05

Fixed in:

1.05

Disclosed:

Jul 20, 2015

CVE-2015-6523 on NVD →

The Portfolio Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.04. This is due to missing or incorrect nonce validation on the prtfl_settings_page() function. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged...

CVSS:

4.3

Affected:

up to 2.04

Fixed in:

2.05

Disclosed:

Jul 24, 2012

CVE-2012-10017 on NVD →