Wp Tell A Friend Popup Form Vulnerabilities

[en] Cross-Site Request Forgery (CSRF) vulnerability in Gopi Ramasamy WP tell a friend popup form plugin <= 7.1 versions.

Affected:

up to 7.1

Fix:

No patched version reported

Disclosed:

Oct 3, 2023

CVE-2023-25463 on NVD →

[en] Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy wp tell a friend popup form plugin <= 7.1 versions.

Affected:

up to 7.1

Fix:

No patched version reported

Disclosed:

Sep 4, 2023

CVE-2023-25465 on NVD →

The wp tell a friend popup form plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 7.1. This is due to missing or incorrect nonce validation on the 'TellAFriend_admin' function. This makes it possible for unauthenticated attackers to change arbitrary plugin settings via a...

CVSS:

5.4

Affected:

up to 7.1

Fix:

No patched version reported

Disclosed:

Jul 26, 2023

CVE-2023-25463 on NVD →

The wp tell a friend popup form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings versions up to, and including, 7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arb...

CVSS:

4.4

Affected:

up to 7.1

Fix:

No patched version reported

Disclosed:

Jul 26, 2023

CVE-2023-25465 on NVD →