CVE-2014-2838

MEDIUM 6.8 CVSS 2.0

Published: January 12, 2015
Last modified: June 17, 2026
NVD status: Modified
Reported by: cve@mitre.org
Weakness: CWE-352
CVSS vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in the GD Star Rating plugin 19.22 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct (1) SQL injection attacks via the s parameter in the gd-star-rating-stats page to wp-admin/admin.php or (2) cross-site scripting (XSS) attacks via unspecified vectors.

Affected products and versions

n/a n/a — Versions not specified
dev4press gd_star_rating — Version 19.22

References

seclists.org http://seclists.org/fulldisclosure/2014/Mar/399 Exploit
secunia.com http://secunia.com/advisories/57667
advisories.dxw.com https://advisories.dxw.com/advisories/csrf-and-blind-sql-injection-in-gd-star-rating-1-9-22/
exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/92156
nvd.nist.gov Official NVD record

WordPress CVEs

Description

Affected products and versions

References