blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2015-10109

HIGH 8.8 CVSS 3.1
Published
June 1, 2023
Last modified
June 17, 2026
NVD status
Modified
Reported by
cna@vuldb.com
Weakness
CWE-352
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

A vulnerability was found in Video Playlist and Gallery Plugin up to 1.136 on WordPress. It has been rated as problematic. Affected by this issue is some unknown functionality of the file wp-media-cincopa.php. The manipulation leads to cross-site request forgery. The attack may be launched remotely. Upgrading to version 1.137 is able to address this issue. The name of the patch is ee28e91f4d5404905204c43b7b84a8ffecad932e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230264.

Affected WordPress components

  • Cincopa video and media plug-in Plugin · video-playlist-and-gallery-plugin
    Confirmed match Active
    Version 1.136
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • n/a Video Playlist and Gallery Plugin — Version 1.136
  • cincopa video_and_media_plug-in — Before 1.137

References

  • github.com https://github.com/wp-plugins/video-playlist-and-gallery-plugin/commit/ee28e91f4d5404905204c43b7b84a8ffecad932e Patch
  • github.com https://github.com/wp-plugins/video-playlist-and-gallery-plugin/releases/tag/1.137 Release Notes
  • vuldb.com https://vuldb.com/?ctiid.230264 Permissions Required, Third Party Advisory
  • vuldb.com https://vuldb.com/?id.230264 Permissions Required, Third Party Advisory
  • nvd.nist.gov Official NVD record