Really Simple Security logo

Log out
Get PRO

Latest

Input validation vulnerability in 11 plugins by a3rev

  • Severity: high-risk
  • Status: Open
  • Publication: November 2, 2022

Several plugins for WordPress are vulnerable to Cross-Site Request Forgery (CSRF). This means that unauthenticated attackers can reset the plugin’s settings by tricking a site administrator into clicking a link or performing another action. The affected plugins are a3 Lazy Load (version 2.6.0 or lower), Contact Us Page – Contact People (version 3.6.1 or lower), a3 Portfolio (version 3.0.1 or lower), Dynamic Product Gallery for WooCommerce (version 3.0.1), a3 Responsive Slider (version 2.2.0 or lower), Compare Products for WooCommerce (version 2.8.2 or lower), Products Quick View for WooCommerce (version 2.0.1 or lower), Product Sort and Display for WooCommerce (version 2.2.2 or lower), and WP Email Template (version 2.6.2 or lower). This vulnerability is caused by a lack of nonce validation on the reset_settings() function.

Detected in:

a3 Lazy Load fixed vulnerable versions: >= * <= 2.6.0
a3 Portfolio fixed vulnerable versions: >= * <= 3.0.1
a3 Responsive Slider fixed vulnerable versions: >= * <= 2.2.0
Compare Products for WooCommerce fixed vulnerable versions: >= * <= 2.8.2
Dynamic Product Gallery for WooCommerce fixed vulnerable versions: >= * <= 3.0.1
Product Widget Slider for WooCommerce fixed vulnerable versions: >= * <= 1.9.1
Products Quick View for WooCommerce fixed vulnerable versions: >= * <= 2.0.1
WP Email Template fixed vulnerable versions: >= * <= 2.6.2
Contact Us Page – Contact People open vulnerable versions: >= * <= 3.6.1
Product Sort and Display for WooCommerce open vulnerable versions: >= * <= 2.2.2

This information is sourced from www.wpvulnerability.com. An open-source database of vulnerabilities maintained by the community. Help us out by submitting vulnerabilities!

Version compare shows which versions have a vulnerability. For example: >= 2.2.8 <= 2.2.21 means:

> from 2.2.8
= including 2.2.8 & 2.2.21
< to 2.2.21

  • Incorrect?

Is this information incorrect? Please leave us a message.