title: Cross-Site Request Forgery (CSRF) vulnerability in multiple WordPress plugins by Meks
description: Cross-Site Request Forgery (CSRF) vulnerability in Meks Video Importer, Meks Time Ago, Meks ThemeForest Smart Widget, Meks Smart Author Widget, Meks Audio Player, Meks Easy Maps, Meks Easy Photo Feed Widget, Meks Simple Flickr Widget, Meks Easy Ads Widget, Meks Smart Social Widget plugins leading to dismiss or the popup.
problem types: CWE-352 Cross-Site Request Forgery (CSRF)
affected:
{
collectionURL: https://wordpress.org/plugins
defaultStatus: unaffected
packageName: meks-video-importer
product: Meks Video Importer
vendor: Meks
versions:
changes: [at: 1.0.11, status: unaffected], lessThanOrEqual: 1.0.10, status: affected, version: n/a, versionType: custom
}
{
collectionURL: https://wordpress.org/plugins
defaultStatus: unaffected
packageName: meks-time-ago
product: Meks Time Ago
vendor: Meks
versions:
changes: [at: 1.1.7, status: unaffected], lessThanOrEqual: 1.1.6, status: affected, version: n/a, versionType: custom
}
{
collectionURL: https://wordpress.org/plugins
defaultStatus: unaffected
packageName: meks-themeforest-smart-widget
product: Meks ThemeForest Smart Widget
vendor: Meks
versions:
changes: [at: 1.5, status: unaffected], lessThanOrEqual: 1.4, status: affected, version: n/a, versionType: custom
}
{
collectionURL: https://wordpress.org/plugins
defaultStatus: unaffected
packageName: meks-smart-author-widget
product: Meks Smart Author Widget
vendor: Meks
versions:
changes: [at: 1.1.4, status: unaffected], lessThanOrEqual: 1.1.3, status: affected, version: n/a, versionType: custom
}
{
collectionURL: https://wordpress.org/plugins
defaultStatus: unaffected
packageName: meks-audio-player
product: Meks Audio Player
vendor: Meks
versions:
changes: [at: 1.3, status: unaffected], lessThanOrEqual: 1.2, status: affected, version: n/a, versionType: custom
}
{
collectionURL: https://wordpress.org/plugins
defaultStatus: unaffected
packageName: meks-easy-maps
product: Meks Easy Maps
vendor: Meks
versions:
changes: [at: 2.1.4, status: unaffected], lessThanOrEqual: 2.1.3, status: affected, version: n/a, versionType: custom
}
{
collectionURL: https://wordpress.org/plugins
defaultStatus: unaffected
packageName: meks-easy-instagram-widget
product: Meks Easy Photo Feed Widget
vendor: Meks
versions:
changes: [at: 1.2.8, status: unaffected], lessThanOrEqual: 1.2.7, status: affected, version: n/a, versionType: custom
}
{
collectionURL: https://wordpress.org/plugins
defaultStatus: unaffected
packageName: meks-simple-flickr-widget
product: Meks Simple Flickr Widget
vendor: Meks
versions:
changes: [at: 1.3, status: unaffected], lessThanOrEqual: 1.2, status: affected, version: n/a, versionType: custom
}
{
collectionURL: https://wordpress.org/plugins
defaultStatus: unaffected
packageName: meks-easy-ads-widget
product: Meks Easy Ads Widget
vendor: Meks
versions:
changes: [at: 2.0.8, status: unaffected], lessThanOrEqual: 2.0.7, status: affected, version: n/a, versionType: custom
}
{
collectionURL: https://wordpress.org/plugins
defaultStatus: unaffected
packageName: meks-smart-social-widget
product: Meks Smart Social Widget
vendor: Meks
versions:
changes: [at: 1.6.1, status: unaffected], lessThanOrEqual: 1.6, status: affected, version: n/a, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Update Meks Video Importer to 1.0.11 or a higher version.