CVE-2023-5884
04.12.2023, 22:15
The Word Balloon WordPress plugin before 4.20.3 does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to trick a logged in user to delete arbitrary avatars by clicking a link.
| Vendor | Product | Version |
|---|---|---|
| back2nature | word_balloon | 𝑥 < 4.20.3 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration