CVE-2013-5672
- State
- Published
- Severity
- Not scored
- Published
- Sep 10, 2013
- Updated
- Aug 6, 2024
- Reserved
- Sep 1, 2013
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in the IndiaNIC Testimonial plugin 2.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) add a testimonial via an iNIC_testimonial_save action; (2) add a listing template via an iNIC_testimonial_save_listing_template action; (3) add a widget template via an iNIC_testimonial_save_widget action; insert cross-site scripting (XSS) sequences via the (4) project_name, (5) project_url, (6) client_name, (7) client_city, (8) client_state, (9) description, (10) tags, (11) video_url, or (12) is_featured, (13) title, (14) widget_title, (15) no_of_testimonials, (16) filter_by_country, (17) filter_by_tags, or (18) widget_template parameter to wp-admin/admin-ajax.php.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 62109vdb-entry
- 20130901 IndiaNIC Testimonial WP plugin - Multiple vulnerabilitiesmailing-list
- [oss-security] 20130901 Re: [CVE Request] IndiaNIC Testimonial 2.2 WP pluginmailing-list
- 54640third-party-advisory
- 28054exploit
- http://packetstormsecurity.com/files/123036
- indianictestimonial-cve20135672-csrf(86846)vdb-entry
- 96792vdb-entry
- 20130901 IndiaNIC Testimonail WP plugin - Multiple vulnerabilitiesmailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.