Vulnerability · Published Oct 3, 2023 · Assigned by Patchstack
CVE-2023-25989Cross-Site Request Forgery (CSRF) vulnerability in multiple WordPress plugins by Meks
Medium 4.3
In plain English
A medium-severity cross-site request forgery in Meks Audio Player from Meks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.4%top 61.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Cross-Site Request Forgery (CSRF) vulnerability in Meks Video Importer, Meks Time Ago, Meks ThemeForest Smart Widget, Meks Smart Author Widget, Meks Audio Player, Meks Easy Maps, Meks Easy Photo Feed Widget, Meks Simple Flickr Widget, Meks Easy Ads Widget, Meks Smart Social Widget plugins leading to dismiss or the popup.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Meks | Meks Video Importer | n/a – through 1.0.10 |
| Meks | Meks Time Ago | n/a – through 1.1.6 |
| Meks | Meks ThemeForest Smart Widget | n/a – through 1.4 |
| Meks | Meks Smart Author Widget | n/a – through 1.1.3 |
| Meks | Meks Audio Player | n/a – through 1.2 |
| Meks | Meks Easy Maps | n/a – through 2.1.3 |
| Meks | Meks Easy Photo Feed Widget | n/a – through 1.2.7 |
| Meks | Meks Simple Flickr Widget | n/a – through 1.2 |
| Meks | Meks Easy Ads Widget | n/a – through 2.0.7 |
| Meks | Meks Smart Social Widget | n/a – through 1.6 |
Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
References
- https://patchstack.com/database/vulnerability/meks-video-importer/wordpress-meks-video-importer-plugin-1-0-10-cross-site-request-forgery-csrf-vulnerability?_s_id=cve vdb-entry
- https://patchstack.com/database/vulnerability/meks-time-ago/wordpress-meks-time-ago-plugin-1-1-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve vdb-entry
- https://patchstack.com/database/vulnerability/meks-themeforest-smart-widget/wordpress-meks-themeforest-smart-widget-plugin-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve vdb-entry
- https://patchstack.com/database/vulnerability/meks-smart-author-widget/wordpress-meks-smart-author-widget-plugin-1-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve vdb-entry
- https://patchstack.com/database/vulnerability/meks-audio-player/wordpress-meks-audio-player-plugin-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve vdb-entry
- https://patchstack.com/database/vulnerability/meks-easy-maps/wordpress-meks-easy-maps-plugin-2-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve vdb-entry
- https://patchstack.com/database/vulnerability/meks-easy-instagram-widget/wordpress-meks-easy-photo-feed-widget-plugin-1-2-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve vdb-entry
- https://patchstack.com/database/vulnerability/meks-simple-flickr-widget/wordpress-meks-simple-flickr-widget-plugin-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve vdb-entry
- https://patchstack.com/database/vulnerability/meks-easy-ads-widget/wordpress-meks-easy-ads-widget-plugin-2-0-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve vdb-entry
- https://patchstack.com/database/vulnerability/meks-smart-social-widget/wordpress-meks-smart-social-widget-plugin-1-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve vdb-entry