Rewterz Threat Advisory – Multiple WordPress Plugins Vulnerabilities

October 19, 2023

Severity

Medium

Analysis Summary

CVE-2023-45267 CVSS:4.3

IRivYou Plugin for WordPress for WordPress is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading an authenticated user to visit a malicious Web site, a remote attacker could send a malformed HTTP request to perform unauthorized actions. An attacker could exploit this vulnerability to perform cross-site scripting attacks, Web cache poisoning, and other malicious activities.

CVE-2023-45656 CVSS:5.4

Lazy Load for Videos Plugin for WordPress is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading an authenticated user to visit a malicious Web site, a remote attacker could send a malformed HTTP request to perform unauthorized actions. An attacker could exploit this vulnerability to perform cross-site scripting attacks, Web cache poisoning, and other malicious activities.

CVE-2023-45653 CVSS:4.3

Video Playlist For YouTube Plugin for WordPress is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading an authenticated user to visit a malicious Web site, a remote attacker could send a malformed HTTP request to perform unauthorized actions. An attacker could exploit this vulnerability to perform cross-site scripting attacks, Web cache poisoning, and other malicious activities.

CVE-2023-5087 CVSS:5.4

PageLayer Plugin for WordPress is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote authenticated attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim’s Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials.

CVE-2023-5089 CVSS:5.3

Defender Security Plugin for WordPress could allow a remote attacker to bypass security restrictions, caused by preventing redirects to the login page via the auth_redirect WordPress function. By sending a specially crafted request, an attacker could exploit this vulnerability to access the login page.

CVE-2023-5133 CVSS:5.4

User Activity Log Pro Plugin for WordPress could allow a remote attacker to conduct spoofing attacks, caused by retrieving client IP addresses from potentially untrusted headers. By manipulating the value, an attacker could exploit this vulnerability to spoof the source of malicious traffic.

CVE-2023-5167 CVSS:4.3

User Activity Log Pro plugin for WordPress is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by user activity logs dashboard. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim’s Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials.

CVE-2023-5177 CVSS:5.3

Vrm 360 3D Model Viewer Plugin for WordPress could allow a remote attacker to obtain sensitive information, caused by exposing the full path of a file when putting in a non-existent file in a parameter of the shortcode. A remote attacker could exploit this vulnerability to obtain sensitive information.

CVE-2023-5561 CVSS:4.8

Popup Builder WordPress Plugin for WordPress is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by its settings. A remote authenticated attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim’s Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials.

CVE-2023-5057 CVSS:5.4

ActivityPub plugin for WordPress is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote authenticated attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim’s Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials.