{"id":"CVE-2023-25989","state":"PUBLISHED","title":"Cross-Site Request Forgery (CSRF) vulnerability in multiple WordPress plugins by Meks","description":"Cross-Site Request Forgery (CSRF) vulnerability in Meks Video Importer, Meks Time Ago, Meks ThemeForest Smart Widget, Meks Smart Author Widget, Meks Audio Player, Meks Easy Maps, Meks Easy Photo Feed Widget, Meks Simple Flickr Widget, Meks Easy Ads Widget, Meks Smart Social Widget plugins leading to dismiss or the popup.","publishedAt":"2023-10-03T11:00:33.837Z","updatedAt":"2026-04-28T16:08:11.292Z","severity":{"score":4.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","source":"Patchstack"},"assigner":"Patchstack","products":["Meks Meks Video Importer","Meks Meks Time Ago","Meks Meks ThemeForest Smart Widget","Meks Meks Smart Author Widget","Meks Meks Audio Player","Meks Meks Easy Maps","Meks Meks Easy Photo Feed Widget","Meks Meks Simple Flickr Widget","Meks Meks Easy Ads Widget","Meks Meks Smart Social Widget"],"affected":[{"vendor":"Meks","product":"Meks Video Importer","packageName":"meks-video-importer","defaultStatus":"unaffected","versions":[{"version":"n/a","status":"affected","lessThanOrEqual":"1.0.10","changes":[{"at":"1.0.11","status":"unaffected"}],"versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"},{"vendor":"Meks","product":"Meks Time Ago","packageName":"meks-time-ago","defaultStatus":"unaffected","versions":[{"version":"n/a","status":"affected","lessThanOrEqual":"1.1.6","changes":[{"at":"1.1.7","status":"unaffected"}],"versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"},{"vendor":"Meks","product":"Meks ThemeForest Smart Widget","packageName":"meks-themeforest-smart-widget","defaultStatus":"unaffected","versions":[{"version":"n/a","status":"affected","lessThanOrEqual":"1.4","changes":[{"at":"1.5","status":"unaffected"}],"versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"},{"vendor":"Meks","product":"Meks Smart Author Widget","packageName":"meks-smart-author-widget","defaultStatus":"unaffected","versions":[{"version":"n/a","status":"affected","lessThanOrEqual":"1.1.3","changes":[{"at":"1.1.4","status":"unaffected"}],"versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"},{"vendor":"Meks","product":"Meks Audio Player","packageName":"meks-audio-player","defaultStatus":"unaffected","versions":[{"version":"n/a","status":"affected","lessThanOrEqual":"1.2","changes":[{"at":"1.3","status":"unaffected"}],"versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"},{"vendor":"Meks","product":"Meks Easy Maps","packageName":"meks-easy-maps","defaultStatus":"unaffected","versions":[{"version":"n/a","status":"affected","lessThanOrEqual":"2.1.3","changes":[{"at":"2.1.4","status":"unaffected"}],"versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"},{"vendor":"Meks","product":"Meks Easy Photo Feed Widget","packageName":"meks-easy-instagram-widget","defaultStatus":"unaffected","versions":[{"version":"n/a","status":"affected","lessThanOrEqual":"1.2.7","changes":[{"at":"1.2.8","status":"unaffected"}],"versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"},{"vendor":"Meks","product":"Meks Simple Flickr Widget","packageName":"meks-simple-flickr-widget","defaultStatus":"unaffected","versions":[{"version":"n/a","status":"affected","lessThanOrEqual":"1.2","changes":[{"at":"1.3","status":"unaffected"}],"versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"},{"vendor":"Meks","product":"Meks Easy Ads Widget","packageName":"meks-easy-ads-widget","defaultStatus":"unaffected","versions":[{"version":"n/a","status":"affected","lessThanOrEqual":"2.0.7","changes":[{"at":"2.0.8","status":"unaffected"}],"versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"},{"vendor":"Meks","product":"Meks Smart Social Widget","packageName":"meks-smart-social-widget","defaultStatus":"unaffected","versions":[{"version":"n/a","status":"affected","lessThanOrEqual":"1.6","changes":[{"at":"1.6.1","status":"unaffected"}],"versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"}],"references":["https://patchstack.com/database/vulnerability/meks-video-importer/wordpress-meks-video-importer-plugin-1-0-10-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","https://patchstack.com/database/vulnerability/meks-time-ago/wordpress-meks-time-ago-plugin-1-1-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","https://patchstack.com/database/vulnerability/meks-themeforest-smart-widget/wordpress-meks-themeforest-smart-widget-plugin-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","https://patchstack.com/database/vulnerability/meks-smart-author-widget/wordpress-meks-smart-author-widget-plugin-1-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","https://patchstack.com/database/vulnerability/meks-audio-player/wordpress-meks-audio-player-plugin-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","https://patchstack.com/database/vulnerability/meks-easy-maps/wordpress-meks-easy-maps-plugin-2-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","https://patchstack.com/database/vulnerability/meks-easy-instagram-widget/wordpress-meks-easy-photo-feed-widget-plugin-1-2-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","https://patchstack.com/database/vulnerability/meks-simple-flickr-widget/wordpress-meks-simple-flickr-widget-plugin-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","https://patchstack.com/database/vulnerability/meks-easy-ads-widget/wordpress-meks-easy-ads-widget-plugin-2-0-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","https://patchstack.com/database/vulnerability/meks-smart-social-widget/wordpress-meks-smart-social-widget-plugin-1-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve"],"weaknesses":["CWE-352"],"ingestedAt":"2026-10-29T20:05:43.909Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/25xxx/CVE-2023-25989.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-25989","state":"PUBLISHED","datePublished":"2023-10-03T11:00:33.837Z","dateUpdated":"2026-04-28T16:08:11.292Z","assignerShortName":"Patchstack","assignerOrgId":"21595511-bba5-4825-b968-b78d1f9984a3","dateReserved":"2023-02-17T13:47:16.259Z"},"containers":{"cna":{"title":"Cross-Site Request Forgery (CSRF) vulnerability in multiple WordPress plugins by Meks","descriptions":[{"lang":"en","value":"Cross-Site Request Forgery (CSRF) vulnerability in Meks Video Importer, Meks Time Ago, Meks ThemeForest Smart Widget, Meks Smart Author Widget, Meks Audio Player, Meks Easy Maps, Meks Easy Photo Feed Widget, Meks Simple Flickr Widget, Meks Easy Ads Widget, Meks Smart Social Widget plugins leading to dismiss or the popup."}],"affected":[{"vendor":"Meks","product":"Meks Video Importer","packageName":"meks-video-importer","defaultStatus":"unaffected","versions":[{"version":"n/a","status":"affected","lessThanOrEqual":"1.0.10","changes":[{"at":"1.0.11","status":"unaffected"}],"versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"},{"vendor":"Meks","product":"Meks Time Ago","packageName":"meks-time-ago","defaultStatus":"unaffected","versions":[{"version":"n/a","status":"affected","lessThanOrEqual":"1.1.6","changes":[{"at":"1.1.7","status":"unaffected"}],"versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"},{"vendor":"Meks","product":"Meks ThemeForest Smart Widget","packageName":"meks-themeforest-smart-widget","defaultStatus":"unaffected","versions":[{"version":"n/a","status":"affected","lessThanOrEqual":"1.4","changes":[{"at":"1.5","status":"unaffected"}],"versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"},{"vendor":"Meks","product":"Meks Smart Author Widget","packageName":"meks-smart-author-widget","defaultStatus":"unaffected","versions":[{"version":"n/a","status":"affected","lessThanOrEqual":"1.1.3","changes":[{"at":"1.1.4","status":"unaffected"}],"versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"},{"vendor":"Meks","product":"Meks Audio Player","packageName":"meks-audio-player","defaultStatus":"unaffected","versions":[{"version":"n/a","status":"affected","lessThanOrEqual":"1.2","changes":[{"at":"1.3","status":"unaffected"}],"versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"},{"vendor":"Meks","product":"Meks Easy Maps","packageName":"meks-easy-maps","defaultStatus":"unaffected","versions":[{"version":"n/a","status":"affected","lessThanOrEqual":"2.1.3","changes":[{"at":"2.1.4","status":"unaffected"}],"versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"},{"vendor":"Meks","product":"Meks Easy Photo Feed Widget","packageName":"meks-easy-instagram-widget","defaultStatus":"unaffected","versions":[{"version":"n/a","status":"affected","lessThanOrEqual":"1.2.7","changes":[{"at":"1.2.8","status":"unaffected"}],"versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"},{"vendor":"Meks","product":"Meks Simple Flickr Widget","packageName":"meks-simple-flickr-widget","defaultStatus":"unaffected","versions":[{"version":"n/a","status":"affected","lessThanOrEqual":"1.2","changes":[{"at":"1.3","status":"unaffected"}],"versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"},{"vendor":"Meks","product":"Meks Easy Ads Widget","packageName":"meks-easy-ads-widget","defaultStatus":"unaffected","versions":[{"version":"n/a","status":"affected","lessThanOrEqual":"2.0.7","changes":[{"at":"2.0.8","status":"unaffected"}],"versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"},{"vendor":"Meks","product":"Meks Smart Social Widget","packageName":"meks-smart-social-widget","defaultStatus":"unaffected","versions":[{"version":"n/a","status":"affected","lessThanOrEqual":"1.6","changes":[{"at":"1.6.1","status":"unaffected"}],"versionType":"custom"}],"collectionURL":"https://wordpress.org/plugins"}],"references":[{"url":"https://patchstack.com/database/vulnerability/meks-video-importer/wordpress-meks-video-importer-plugin-1-0-10-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","tags":["vdb-entry"]},{"url":"https://patchstack.com/database/vulnerability/meks-time-ago/wordpress-meks-time-ago-plugin-1-1-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","tags":["vdb-entry"]},{"url":"https://patchstack.com/database/vulnerability/meks-themeforest-smart-widget/wordpress-meks-themeforest-smart-widget-plugin-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","tags":["vdb-entry"]},{"url":"https://patchstack.com/database/vulnerability/meks-smart-author-widget/wordpress-meks-smart-author-widget-plugin-1-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","tags":["vdb-entry"]},{"url":"https://patchstack.com/database/vulnerability/meks-audio-player/wordpress-meks-audio-player-plugin-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","tags":["vdb-entry"]},{"url":"https://patchstack.com/database/vulnerability/meks-easy-maps/wordpress-meks-easy-maps-plugin-2-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","tags":["vdb-entry"]},{"url":"https://patchstack.com/database/vulnerability/meks-easy-instagram-widget/wordpress-meks-easy-photo-feed-widget-plugin-1-2-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","tags":["vdb-entry"]},{"url":"https://patchstack.com/database/vulnerability/meks-simple-flickr-widget/wordpress-meks-simple-flickr-widget-plugin-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","tags":["vdb-entry"]},{"url":"https://patchstack.com/database/vulnerability/meks-easy-ads-widget/wordpress-meks-easy-ads-widget-plugin-2-0-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","tags":["vdb-entry"]},{"url":"https://patchstack.com/database/vulnerability/meks-smart-social-widget/wordpress-meks-smart-social-widget-plugin-1-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","tags":["vdb-entry"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-352","description":"CWE-352 Cross-Site Request Forgery (CSRF)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Patchstack","orgId":"21595511-bba5-4825-b968-b78d1f9984a3","dateUpdated":"2026-04-28T16:08:11.292Z"},"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"Muhammad Daffa (Patchstack Alliance)"}],"impacts":[{"capecId":"CAPEC-62","descriptions":[{"lang":"en","value":"CAPEC-62 Cross Site Request Forgery"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Update Meks Video Importer to 1.0.11 or a higher version.<br>"}],"value":"Update Meks Video Importer to 1.0.11 or a higher version."},{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Update Meks Time Ago to 1.1.7 or a higher version."}],"value":"Update Meks Time Ago to 1.1.7 or a higher version."},{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Update Meks ThemeForest Smart Widget to 1.5 or a higher version."}],"value":"Update Meks ThemeForest Smart Widget to 1.5 or a higher version."},{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Update Meks Smart Author Widget to 1.1.4 or a higher version.<br>"}],"value":"Update Meks Smart Author Widget to 1.1.4 or a higher version."},{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Update Meks Audio Player to 1.3 or a higher version."}],"value":"Update Meks Audio Player to 1.3 or a higher version."},{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Update Meks Easy Maps to 2.1.4 or a higher version.<br>"}],"value":"Update Meks Easy Maps to 2.1.4 or a higher version."},{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Update Meks Easy Photo Feed Widget to 1.2.8 or a higher version.<br>"}],"value":"Update Meks Easy Photo Feed Widget to 1.2.8 or a higher version."},{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Update Meks Simple Flickr Widget to 1.3 or a higher version."}],"value":"Update Meks Simple Flickr Widget to 1.3 or a higher version."},{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Update Meks Easy Ads Widget to 2.0.8 or a higher version."}],"value":"Update Meks Easy Ads Widget to 2.0.8 or a higher version."},{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Update Meks Smart Social Widget to 1.6.1 or a higher version."}],"value":"Update Meks Smart Social Widget to 1.6.1 or a higher version."}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://patchstack.com/database/vulnerability/meks-video-importer/wordpress-meks-video-importer-plugin-1-0-10-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","tags":["vdb-entry","x_transferred"]},{"url":"https://patchstack.com/database/vulnerability/meks-time-ago/wordpress-meks-time-ago-plugin-1-1-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","tags":["vdb-entry","x_transferred"]},{"url":"https://patchstack.com/database/vulnerability/meks-themeforest-smart-widget/wordpress-meks-themeforest-smart-widget-plugin-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","tags":["vdb-entry","x_transferred"]},{"url":"https://patchstack.com/database/vulnerability/meks-smart-author-widget/wordpress-meks-smart-author-widget-plugin-1-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","tags":["vdb-entry","x_transferred"]},{"url":"https://patchstack.com/database/vulnerability/meks-audio-player/wordpress-meks-audio-player-plugin-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","tags":["vdb-entry","x_transferred"]},{"url":"https://patchstack.com/database/vulnerability/meks-easy-maps/wordpress-meks-easy-maps-plugin-2-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","tags":["vdb-entry","x_transferred"]},{"url":"https://patchstack.com/database/vulnerability/meks-easy-instagram-widget/wordpress-meks-easy-photo-feed-widget-plugin-1-2-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","tags":["vdb-entry","x_transferred"]},{"url":"https://patchstack.com/database/vulnerability/meks-simple-flickr-widget/wordpress-meks-simple-flickr-widget-plugin-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","tags":["vdb-entry","x_transferred"]},{"url":"https://patchstack.com/database/vulnerability/meks-easy-ads-widget/wordpress-meks-easy-ads-widget-plugin-2-0-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","tags":["vdb-entry","x_transferred"]},{"url":"https://patchstack.com/database/vulnerability/meks-smart-social-widget/wordpress-meks-smart-social-widget-plugin-1-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","tags":["vdb-entry","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T11:39:06.570Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-08-02T14:40:09.555989Z","id":"CVE-2023-25989","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-08-02T14:48:57.427Z"}}]}}}