CVE-2023-3320
MediumCVSS 6.1Exploitation Probability (EPSS)
Elevated risk67th percentile - higher than 67% of all known CVEs
Summary
The WP Sticky Social plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.0.1. This is due to missing nonce validation in the ~/admin/views/admin.php file, allowing unauthenticated attackers to modify the plugin's settings and inject malicious web scripts via a forged request.
Risk Assessment
Attackers can exploit this vulnerability to change plugin settings, potentially leading to the injection of malicious code on the site, jeopardizing user security and the integrity of the service.
Recommendation
It is recommended to update the WP Sticky Social plugin to the latest version to mitigate this vulnerability. Additionally, implementing CSRF protection mechanisms in web applications is advisable.
Original NVD description (English source)
The WP Sticky Social plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. This is due to missing nonce validation in the ~/admin/views/admin.php file. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.