CVE-2014-5347

Disqus Comment System < 2.75 - CSRF

Title source: rule

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin before 2.76 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) disqus_replace, (2) disqus_public_key, or (3) disqus_secret_key parameter to wp-admin/edit-comments.php in manage.php or that (4) reset or (5) delete plugin options via the reset parameter to wp-admin/edit-comments.php.

Exploits (1)

exploitdb WORKING POC
by Nik Cubrilovic · htmlwebappsphp
https://www.exploit-db.com/exploits/34336

References (10)

Scores

EPSS 0.0302
EPSS Percentile 86.7%

Details

CWE
CWE-352
Status published
Products (32)
disqus/disqus_comment_system 2.40
disqus/disqus_comment_system 2.41
disqus/disqus_comment_system 2.42
disqus/disqus_comment_system 2.43
disqus/disqus_comment_system 2.44
disqus/disqus_comment_system 2.45
disqus/disqus_comment_system 2.46
disqus/disqus_comment_system 2.47
disqus/disqus_comment_system 2.48
disqus/disqus_comment_system 2.49
... and 22 more
Published Aug 19, 2014
Tracked Since Feb 18, 2026