Nextend Social Login and Register, 9d33cb45c6b99122e0c0e635939fd5605cfcfc48

CVE, Research URL: 9d33cb45c6b99122e0c0e635939fd5605cfcfc48
Home page URL: Security reports for Nextend Social Login and Register
Application: Nextend Social Login and Register
Published on: Mar 15, 2016
Research Description: Nextend Social Login and Register [nextend-facebook-connect] < 1.5.9 Nextend Facebook Connect <= 1.5.8 - Cross-Site Request Forgery The Nextend Facebook Connect plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.8. This is due to missing nonce validation on the store_settings() function. This makes it possible for unauthenticated attackers to update the plugins settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected versions: max 1.5.9.
Status: vulnerable