4.3Mittel

CVE-2023-5823WordPress TK Google Fonts GDPR Compliant Plugin <= 2.2.11 is vulnerable to Cross Site Request Forgery (CSRF)

ThemeKraft TK Google Fonts GDPR Compliant Veröffentlicht: 2023-11-06 14:21 (vor 3 Jahren)

Beschreibung

Cross-Site Request Forgery (CSRF) vulnerability in ThemeKraft TK Google Fonts GDPR Compliant plugin <= 2.2.11 versions.

Schwachstellentyp (CWE): CWE-352

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
ThemeKraft	TK Google Fonts GDPR Compliant	≤ 2.2.11

Referenzen und Patches

https://patchstack.com/database/vulnerability/tk-google-fonts/wordpress-tk-google-fonts-gdpr-compliant-plugin… vdb-entry

CVSS-Score

4.3Mittel

Quelle: Patchstack · CVSS 3.1

Angriffsvektor: Netzwerk
Komplexität: Niedrig
Rechte erforderlich: Keine
Benutzerinteraktion: Erforderlich
Geltungsbereich: Unverändert
Vertraulichkeit: Keine
Integrität: Niedrig
Verfügbarkeit: Keine

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Alle Scores (2)

cna	CVSS 3.1	4.3Mittel
CISA-ADP	CVSS 3.1	8.8Hoch

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

0.26%

höher als 17 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: none
Automatisierbar: no
Technische Auswirkung: total

Zeitverlauf

ID reserviert2023-10-27
Veröffentlicht2023-11-06 14:21
Bei IP-DB eingegangen2026-10-24 23:52
Zuletzt aktualisiert2026-04-29 12:51

Vergeben von (CNA): Patchstack

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — WordPress plugins & themes

8.8Hoch

CVE-2026-124251 vor 10 Stunden

WordPress WPIDE – File Manager & Code Editor plugin <= 3.6.4 - Cross Site Request Forgery (CSRF) vulnerability

XplodedThemes WPIDE – File Manager & Code Editor

Cross-Site Request Forgery (CSRF) vulnerability in XplodedThemes WPIDE – File Manager & Code Editor wpide allows Cross Site Request Forgery.This issue affects WPIDE – File Manager & Code Editor: from n/a through 3.6.4.

5.3Mittel

CVE-2026-106007 vor 18 Stunden

FraudLabs Pro SMS Verification <= 1.12.1 - Unauthenticated Unrestricted SMS Sending via wp_sms_action_send

FraudLabs Pro SMS Verification

The FraudLabs Pro SMS Verification WordPress plugin through 1.12.1 does not enforce its SMS-retry limit on the server side, allowing unauthenticated users to send an unlimited number of verification SMS messages to attacker-chosen phone numbers, exhausting th…

5.3Mittel

CVE-2026-106025 vor 18 Stunden

Cargo Shipping Location for WooCommerce 4.0.0 - 5.7.1 - Unauthenticated Order Status Manipulation

Cargo Shipping Location for WooCommerce

The Cargo Shipping Location for WooCommerce WordPress plugin before 6.0 does not properly restrict access to a REST API endpoint that updates order shipment statuses, relying on an attacker-controllable value for authorization, allowing unauthenticated users …

7.2Hoch

CVE-2026-84938 vor 19 Stunden

Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Stored Cross-Site Scripting via Form Notification Dynamic-Data action_hook

themefusion Avada (Fusion) Builder

The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Notification Dynamic-Data action_hook → Media Upload Chain (ID3 Metadata / html_attributes) in all versions up to, and including, 3.16.1 due to insufficient …

7.5Hoch

CVE-2026-100386 vor 19 Stunden

Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Arbitrary File Read via CF7 Field Value in mPDF WriteHTML SVG Parser

themefic Ultra Addons for Contact Form 7

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.5.54 via the uacf7_wpcf7_mail_components function. This makes it possible for unauthenticated attackers to read the contents …

7.2Hoch

CVE-2026-93427 vor 19 Stunden

ARMember Premium <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via Registration Custom Field

armember ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup

The ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Registration Custom Field (Profile Cover) in all versions up to, and including, 7.8.…