vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2023-3977

Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function

MEDIUM
4.3
CVSS Score
Published: July 28, 2023 at 04:37 AM UTC
Updated: June 17, 2026 at 06:15 AM UTC
20 products affected across 9 vendorsBackup MigrationSocial Media Share Buttons & Social Sharing IconsClone

Using SSL Mixed Content Fix by steve85b?

Get instant alerts when new vulnerabilities affect SSL Mixed Content Fix - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM4.3
Exploit prediction
EPSS 0.6%
SSVC
No known exploit

Description

Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for unauthenticated attackers to install plugins from the limited list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Backup Migration· Backupblisswordpress-plugin
95%
v < 1.2.8
Affected range stops below 1.2.8, so it looks safe — our inference, not a vendor statement
Clone· Backupblisswordpress-plugin
95%
v < 2.3.8
Affected range stops below 2.3.8, so it looks safe — our inference, not a vendor statement
Duplicate Post· Copy Delete Posts
95%
v < 1.4.0
Affected range stops below 1.4.0, so it looks safe — our inference, not a vendor statement
Enhanced Text Widget· Inisev
95%
v < 1.5.8
Affected range stops below 1.5.8, so it looks safe — our inference, not a vendor statement
Redirection· Inisevwordpress-plugin
95%
v ≤ 1.1.3v < 1.1.4
Affected range stops below 1.1.4, so it looks safe — our inference, not a vendor statement
Rss Redirect & Feedburner Alternative· Inisev
95%
v < 3.8
Affected range stops below 3.8, so it looks safe — our inference, not a vendor statement
SSL Mixed Content Fix· Inisev
95%
v < 3.2.4
Affected range stops below 3.2.4, so it looks safe — our inference, not a vendor statement
Ultimate Posts Widget· Inisev
95%
v < 2.2.5
Affected range stops below 2.2.5, so it looks safe — our inference, not a vendor statement
Pop Up· Mypopups
95%
v < 1.2.0
Affected range stops below 1.2.0, so it looks safe — our inference, not a vendor statement
Social Media Share Buttons & Social Sharing Icons· Ultimatelysocialwordpress-plugin
95%
v < 3.5.8
Affected range stops below 3.5.8, so it looks safe — our inference, not a vendor statement

References (23)

Exploit
Source: [email protected]
https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.2.7/includes/banner/misc.php#L427
Exploit
Source: [email protected]
https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.2.8/includes/banner/misc.php#L434
Exploit
Source: [email protected]
https://plugins.trac.wordpress.org/browser/copy-delete-posts/tags/1.3.8/banner/misc.php#L426
Exploit
Source: [email protected]
https://plugins.trac.wordpress.org/browser/copy-delete-posts/tags/1.4.0/banner/misc.php#L434
Exploit
Source: [email protected]
https://plugins.trac.wordpress.org/browser/enhanced-text-widget/tags/1.5.6/banner/misc.php#L339
Exploit
Source: [email protected]
https://plugins.trac.wordpress.org/browser/enhanced-text-widget/tags/1.5.7/banner/misc.php#L351
Exploit
Source: [email protected]
https://plugins.trac.wordpress.org/browser/feedburner-alternative-and-rss-redirect/tags/3.7/modules/banner/misc.php#L427
Exploit
Source: [email protected]
https://plugins.trac.wordpress.org/browser/http-https-remover/tags/3.2.3/banner/misc.php#L427

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

4.3MEDIUMWordfence
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-352

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card