blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2015-5483

HIGH 8.8 CVSS 3.1
Published
January 28, 2020
Last modified
June 17, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-352
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in the Private Only plugin 3.5.1 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) add users, (2) delete posts, or (3) modify PHP files via unspecified vectors, or (4) conduct cross-site scripting (XSS) attacks via the po_logo parameter in the privateonly.php page to wp-admin/options-general.php.

Affected products and versions

  • n/a n/a — Versions not specified
  • private_only_project private_only — Version 3.5.1

References

  • packetstormsecurity.com http://packetstormsecurity.com/files/133349/WordPress-Private-Only-3.5.1-CSRF-Cross-Site-Scripting.html Exploit, Third Party Advisory, VDB Entry
  • seclists.org http://seclists.org/fulldisclosure/2015/Aug/77 Exploit, Mailing List, Third Party Advisory
  • security.dxw.com https://security.dxw.com/advisories/csrfxss-vulnerability-in-private-only-could-allow-an-attacker-to-do-almost-anything-an-admin-user-can/ Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record