CVE-2014-2838
NONE EPSS 58.9%
Published Jan 12, 201511y ago · Modified Jun 17, 20262w ago
Published Jan 12, 2015 11y ago
Last Modified Jun 17, 2026 2w ago
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in the GD Star Rating plugin 19.22 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct (1) SQL injection attacks via the s parameter in the gd-star-rating-stats page to wp-admin/admin.php or (2) cross-site scripting (XSS) attacks via unspecified vectors.
Threat Intelligence
EPSS Exploit Probability
58.9% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available
Weaknesses 1
CWE-352 Cross-Site Request Forgery (CSRF) Authentication
Affected Products 1
| Vendor | Product | Version | Range |
|---|---|---|---|
| dev4press | gd_star_rating | 19.22 | any |
References 4
- seclists.org http://seclists.org/fulldisclosure/2014/Mar/399
- secunia.com http://secunia.com/advisories/57667
- advisories.dxw.com https://advisories.dxw.com/advisories/csrf-and-blind-sql-injection-in-gd-star-rating-1-9-22/
- exchange.xforce.ibmcloud.com https://exchange.xforce.ibmcloud.com/vulnerabilities/92156
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.