medium6.8Public exploit code
CVE-2015-2084
Cross-site request forgery (CSRF) vulnerability in the Easy Social Icons plugin before 1.2.3 for WordPress allows remote attackers to hijack the authentication…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- WordPress Plugin Easy Social Icons 1.2.2 - Cross-Site Request Forgery2015-02-23 · webapps · php
Impact
Cross-site request forgery (CSRF) vulnerability in the Easy Social Icons plugin before 1.2.3 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the image_file parameter in an edit action in the cnss_social_icon_add page to wp-admin/admin.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cybernetikz | Easy Social Icons | through 1.2.2 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/130461/WordPress-Easy-Social-Icons-1.2.2-CSRF-XSS.html
- http://seclists.org/fulldisclosure/2015/Feb/76
- http://www.exploit-db.com/exploits/36161
- http://www.securityfocus.com/bid/74893
- https://wordpress.org/plugins/easy-social-icons/changelog/
- http://packetstormsecurity.com/files/130461/WordPress-Easy-Social-Icons-1.2.2-CSRF-XSS.html
- http://seclists.org/fulldisclosure/2015/Feb/76
- http://www.exploit-db.com/exploits/36161
- http://www.securityfocus.com/bid/74893
- https://wordpress.org/plugins/easy-social-icons/changelog/