« Volver al listado

CVE-2023-25989

Estado: ModificadaAlta (8.8)—

Cross-Site Request Forgery (CSRF) vulnerability in Meks Video Importer, Meks Time Ago, Meks ThemeForest Smart Widget, Meks Smart Author Widget, Meks Audio Player, Meks Easy Maps, Meks Easy Photo Feed Widget, Meks Simple Flickr Widget, Meks Easy Ads Widget, Meks Smart Social Widget plugins leading to dismiss or the popup.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (10)

Mekshq — Meks Audio PlayerMekshq — Meks Easy ADS WidgetMekshq — Meks Easy MapsMekshq — Meks Easy Photo Feed WidgetMekshq — Meks Simple Flickr WidgetMekshq — Meks Smart Author WidgetMekshq — Meks Smart Social WidgetMekshq — Meks Themeforest Smart WidgetMekshq — Meks Time AGOMekshq — Meks Video Importer

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-25989",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-25989",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-02T14:40:09.555989Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "audit@patchstack.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "audit@patchstack.com",
      "affectedData": [
        {
          "vendor": "Meks",
          "product": "Meks Video Importer",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "1.0.11",
                  "status": "unaffected"
                }
              ],
              "version": "n/a",
              "versionType": "custom",
              "lessThanOrEqual": "1.0.10"
            }
          ],
          "packageName": "meks-video-importer",
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Meks",
          "product": "Meks Time Ago",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "1.1.7",
                  "status": "unaffected"
                }
              ],
              "version": "n/a",
              "versionType": "custom",
              "lessThanOrEqual": "1.1.6"
            }
          ],
          "packageName": "meks-time-ago",
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Meks",
          "product": "Meks ThemeForest Smart Widget",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "1.5",
                  "status": "unaffected"
                }
              ],
              "version": "n/a",
              "versionType": "custom",
              "lessThanOrEqual": "1.4"
            }
          ],
          "packageName": "meks-themeforest-smart-widget",
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Meks",
          "product": "Meks Smart Author Widget",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "1.1.4",
                  "status": "unaffected"
                }
              ],
              "version": "n/a",
              "versionType": "custom",
              "lessThanOrEqual": "1.1.3"
            }
          ],
          "packageName": "meks-smart-author-widget",
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Meks",
          "product": "Meks Audio Player",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "1.3",
                  "status": "unaffected"
                }
              ],
              "version": "n/a",
              "versionType": "custom",
              "lessThanOrEqual": "1.2"
            }
          ],
          "packageName": "meks-audio-player",
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Meks",
          "product": "Meks Easy Maps",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "2.1.4",
                  "status": "unaffected"
                }
              ],
              "version": "n/a",
              "versionType": "custom",
              "lessThanOrEqual": "2.1.3"
            }
          ],
          "packageName": "meks-easy-maps",
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Meks",
          "product": "Meks Easy Photo Feed Widget",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "1.2.8",
                  "status": "unaffected"
                }
              ],
              "version": "n/a",
              "versionType": "custom",
              "lessThanOrEqual": "1.2.7"
            }
          ],
          "packageName": "meks-easy-instagram-widget",
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Meks",
          "product": "Meks Simple Flickr Widget",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "1.3",
                  "status": "unaffected"
                }
              ],
              "version": "n/a",
              "versionType": "custom",
              "lessThanOrEqual": "1.2"
            }
          ],
          "packageName": "meks-simple-flickr-widget",
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Meks",
          "product": "Meks Easy Ads Widget",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "2.0.8",
                  "status": "unaffected"
                }
              ],
              "version": "n/a",
              "versionType": "custom",
              "lessThanOrEqual": "2.0.7"
            }
          ],
          "packageName": "meks-easy-ads-widget",
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Meks",
          "product": "Meks Smart Social Widget",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "1.6.1",
                  "status": "unaffected"
                }
              ],
              "version": "n/a",
              "versionType": "custom",
              "lessThanOrEqual": "1.6"
            }
          ],
          "packageName": "meks-smart-social-widget",
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-10-03T12:15:10.243",
  "references": [
    {
      "url": "https://patchstack.com/database/vulnerability/meks-audio-player/wordpress-meks-audio-player-plugin-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "audit@patchstack.com"
    },
    {
      "url": "https://patchstack.com/database/vulnerability/meks-easy-ads-widget/wordpress-meks-easy-ads-widget-plugin-2-0-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "audit@patchstack.com"
    },
    {
      "url": "https://patchstack.com/database/vulnerability/meks-easy-instagram-widget/wordpress-meks-easy-photo-feed-widget-plugin-1-2-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "audit@patchstack.com"
    },
    {
      "url": "https://patchstack.com/database/vulnerability/meks-easy-maps/wordpress-meks-easy-maps-plugin-2-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "audit@patchstack.com"
    },
    {
      "url": "https://patchstack.com/database/vulnerability/meks-simple-flickr-widget/wordpress-meks-simple-flickr-widget-plugin-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "audit@patchstack.com"
    },
    {
      "url": "https://patchstack.com/database/vulnerability/meks-smart-author-widget/wordpress-meks-smart-author-widget-plugin-1-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "audit@patchstack.com"
    },
    {
      "url": "https://patchstack.com/database/vulnerability/meks-smart-social-widget/wordpress-meks-smart-social-widget-plugin-1-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "audit@patchstack.com"
    },
    {
      "url": "https://patchstack.com/database/vulnerability/meks-themeforest-smart-widget/wordpress-meks-themeforest-smart-widget-plugin-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "audit@patchstack.com"
    },
    {
      "url": "https://patchstack.com/database/vulnerability/meks-time-ago/wordpress-meks-time-ago-plugin-1-1-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "audit@patchstack.com"
    },
    {
      "url": "https://patchstack.com/database/vulnerability/meks-video-importer/wordpress-meks-video-importer-plugin-1-0-10-cross-site-request-forgery-csrf-vulnerability?_s_id=cve",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "audit@patchstack.com"
    },
    {
      "url": "https://patchstack.com/database/vulnerability/meks-audio-player/wordpress-meks-audio-player-plugin-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://patchstack.com/database/vulnerability/meks-easy-ads-widget/wordpress-meks-easy-ads-widget-plugin-2-0-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://patchstack.com/database/vulnerability/meks-easy-instagram-widget/wordpress-meks-easy-photo-feed-widget-plugin-1-2-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://patchstack.com/database/vulnerability/meks-easy-maps/wordpress-meks-easy-maps-plugin-2-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://patchstack.com/database/vulnerability/meks-simple-flickr-widget/wordpress-meks-simple-flickr-widget-plugin-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://patchstack.com/database/vulnerability/meks-smart-author-widget/wordpress-meks-smart-author-widget-plugin-1-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://patchstack.com/database/vulnerability/meks-smart-social-widget/wordpress-meks-smart-social-widget-plugin-1-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://patchstack.com/database/vulnerability/meks-themeforest-smart-widget/wordpress-meks-themeforest-smart-widget-plugin-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://patchstack.com/database/vulnerability/meks-time-ago/wordpress-meks-time-ago-plugin-1-1-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://patchstack.com/database/vulnerability/meks-video-importer/wordpress-meks-video-importer-plugin-1-0-10-cross-site-request-forgery-csrf-vulnerability?_s_id=cve",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "audit@patchstack.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-Site Request Forgery (CSRF) vulnerability in Meks Video Importer, Meks Time Ago, Meks ThemeForest Smart Widget, Meks Smart Author Widget, Meks Audio Player, Meks Easy Maps, Meks Easy Photo Feed Widget, Meks Simple Flickr Widget, Meks Easy Ads Widget, Meks Smart Social Widget plugins leading to dismiss or the popup."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de Cross-Site Request Forgery (CSRF) en Meks Video Importer, Meks Time Ago, Meks ThemeForest Smart Widget, Meks Smart Author Widget, Meks Audio Player, Meks Easy Maps, Meks Easy Photo Feed Widget, Meks Simple Flickr Widget, Meks Easy Ads Widget, complementos de Meks Smart Social Widget que llevan a descartar o a la ventana emergente."
    }
  ],
  "lastModified": "2026-06-17T05:42:26.137",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mekshq:meks_audio_player:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EC02B0CC-ED27-4331-B543-EE8C454F4AA7",
              "versionEndIncluding": "1.2"
            },
            {
              "criteria": "cpe:2.3:a:mekshq:meks_easy_ads_widget:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "943CF6C8-CE04-4BCA-A795-583E445C21D9",
              "versionEndIncluding": "2.0.7"
            },
            {
              "criteria": "cpe:2.3:a:mekshq:meks_easy_maps:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BF931F5A-5D01-4628-B6B4-07D4240369EC",
              "versionEndIncluding": "2.1.3"
            },
            {
              "criteria": "cpe:2.3:a:mekshq:meks_easy_photo_feed_widget:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0DC9E401-9C5F-4201-86DE-885CAA90E733",
              "versionEndIncluding": "1.2.7"
            },
            {
              "criteria": "cpe:2.3:a:mekshq:meks_simple_flickr_widget:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "368EC2E4-83F6-4585-B785-FD53DD560E4B",
              "versionEndIncluding": "1.2"
            },
            {
              "criteria": "cpe:2.3:a:mekshq:meks_smart_author_widget:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D897F092-B8F6-48F7-B708-9D02B9CBC550",
              "versionEndIncluding": "1.1.3"
            },
            {
              "criteria": "cpe:2.3:a:mekshq:meks_smart_social_widget:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6AB00D03-7628-464A-AA3E-9F8F0D2E7E69",
              "versionEndIncluding": "1.6"
            },
            {
              "criteria": "cpe:2.3:a:mekshq:meks_themeforest_smart_widget:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "20F4C22F-6C64-4976-A29E-6300F494E53C",
              "versionEndIncluding": "1.4"
            },
            {
              "criteria": "cpe:2.3:a:mekshq:meks_time_ago:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7FC60AB4-9876-4AE6-99F9-F97007A9FDC8",
              "versionEndIncluding": "1.1.6"
            },
            {
              "criteria": "cpe:2.3:a:mekshq:meks_video_importer:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A68C994C-0276-4273-85F2-19EE23EFCECE",
              "versionEndIncluding": "1.0.10"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "audit@patchstack.com"
}