Medium severity4.3NVD Advisory· Published Oct 18, 2023· Updated Jun 17, 2026
CVE-2023-3254
CVE-2023-3254
Description
The Widgets for Google Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.9. This is due to missing or incorrect nonce validation within setup_no_reg_header.php. This makes it possible for unauthenticated attackers to reset plugin settings and remove reviews via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected products
2- cpe:2.3:a:trustedindex:widgets_for_google_reviews:*:*:*:*:*:wordpress:*:*Range: <=10.9
- Range: <=10.9
Patches
Vulnerability mechanics
References
2- plugins.trac.wordpress.org/changesetnvdPatch
- www.wordfence.com/threat-intel/vulnerabilities/id/70968476-b064-477f-999f-4aa2c51d89ccnvdProductThird Party Advisory
News mentions
0No linked articles in our index yet.