CVE-2022-3240 - Follow Me Plugin <= 3.1.1 - Cross-Site Request Forgery to Cross-Site Scripting

Back Back to CVE browser

HIGH

Follow Me Plugin <= 3.1.1 - Cross-Site Request Forgery to Cross-Site Scripting

Published Nov 15, 2022

8.8

HIGH

CVSS 3.1

EPSS 0.60%

Description

The "Follow Me Plugin" plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1.1. This is due to missing nonce validation on the FollowMeIgniteSocialMedia_options_page() function. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Affected products

Vendor Brian-Chappell Product Follow Me Plugin Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=3.1.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Brian-Chappell

Follow Me Plugin

unaffected

Version	Status	Constraints
0	affected	<=3.1.1

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-352

CSRF

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-42648
Advisory
https://plugins.trac.wordpress.org/browser/follow-me/trunk/follow-me.php#L261
ExploitThird Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/25fab7b3-59ce-44ca-83fa-bd25b7f31af0?source=cve
https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3240
Third Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-42648		Advisory
https://plugins.trac.wordpress.org/browser/follow-me/trunk/follow-me.php#L261		ExploitThird Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/25fab7b3-59ce-44ca-83fa-bd25b7f31af0?source=cve
https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3240		Third Party Advisory