CVE-2014-9413

IP Ban 1.2.3 - Cross-Site Request Forgery via ip_list, user_agent_list, or redirect_url Parameter

Title source: llm
STIX 2.1

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in the IP Ban (simple-ip-ban) plugin 1.2.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) ip_list, (2) user_agent_list, or (3) redirect_url parameter in the simple-ip-ban page to wp-admin/options-general.php.

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/99503
Patch, Vendor Advisory x_refsource_confirm
https://wordpress.org/plugins/simple-ip-ban/changelog/

Scores

EPSS 0.0117
EPSS Percentile 63.7%

Details

CWE
CWE-352
Status published
Products (1)
ip_ban_project/ip_ban 1.2.3
Published Dec 24, 2014
Tracked Since Feb 18, 2026