The WebberZone plugin for WordPress, “Top 10 – WordPress Popular posts”, is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.2. This means that without proper authentication an attacker could manipulate the post count by tricking a site administrator into clicking a link. This is because the ‘edit_count_ajax’ function does not have proper nonce validation.