CVE-2024-13883

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-13883
The WPUpper Share Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.51. This is due to missing or incorrect nonce validation on the 'save_custom_css_request' function. This makes it possible for unauthenticated attackers to inject custom CSS to modify a site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://plugins.trac.wordpress.org/browser/wpupper-share-buttons/trunk/Controller/ajax.controller.php#L94 Product
https://www.wordfence.com/threat-intel/vulnerabilities/id/5ca55c87-6548-43b8-a23f-d31a51df9533?source=cve Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:victorfreitas:wpupper_share_buttons:*:*:*:*:*:wordpress:*:*
History

25 Feb 2025, 03:39

Type Values Removed Values Added
CPE cpe:2.3:a:victorfreitas:wpupper_share_buttons:*:*:*:*:*:wordpress:*:*
First Time Victorfreitas
Victorfreitas wpupper Share Buttons
References () https://plugins.trac.wordpress.org/browser/wpupper-share-buttons/trunk/Controller/ajax.controller.php#L94 - () https://plugins.trac.wordpress.org/browser/wpupper-share-buttons/trunk/Controller/ajax.controller.php#L94 - Product
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/5ca55c87-6548-43b8-a23f-d31a51df9533?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/5ca55c87-6548-43b8-a23f-d31a51df9533?source=cve - Third Party Advisory
Summary
  • (es) El complemento WPUpper Share Buttons para WordPress es vulnerable a Cross-Site Request Forgery en todas las versiones hasta la 3.51 incluida. Esto se debe a una validación de nonce incorrecta o faltante en la función 'save_custom_css_request'. Esto hace posible que atacantes no autenticados inyecten CSS personalizado para modificar un sitio a través de una solicitud falsificada, siempre que puedan engañar a un administrador del sitio para que realice una acción como hacer clic en un enlace.

21 Feb 2025, 04:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-21 04:15

Updated : 2025-02-25 03:39

NVD link : CVE-2024-13883

Mitre link : CVE-2024-13883

CVE.ORG link : CVE-2024-13883

JSON object : View

Products Affected

victorfreitas

  • wpupper_share_buttons
CWE
CWE-352

Cross-Site Request Forgery (CSRF)