Description
Multiple cross-site request forgery (CSRF) vulnerabilities in the Bird Feeder plugin 1.2.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) user or (2) password parameter in the bird-feeder page to wp-admin/options-general.php.
References (4)
Core 4
Core References
Exploit x_refsource_misc
http://packetstormsecurity.com/files/129623/WordPress-Bird-Feeder-1.2.3-CSRF-XSS.html
Exploit mailing-list
x_refsource_fulldisc
http://seclists.org/fulldisclosure/2014/Dec/69
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/99474
Exploit x_refsource_misc
http://www.vulnerability-lab.com/get_content.php?id=1372
Scores
EPSS
0.0115
EPSS Percentile
63.1%
Details
CWE
CWE-352
Status
published
Products (1)
bird_feeder_project/bird_feeder
1.2.3
Published
Dec 24, 2014
Tracked Since
Feb 18, 2026