CVE-2015-4140

WP Smiley 1.4.1 - Cross-Site Request Forgery via s4w-more Parameter

Title source: llm

Description

Cross-site request forgery (CSRF) vulnerability in the WP Smiley plugin 1.4.1 for WordPress allows remote attackers to hijack the authentication of editors for requests that conduct cross-site scripting (XSS) attacks via the s4w-more parameter to the smilies4wp.php page to wp-admin/options-general.php.

References (3)

Core 3

Core References

Mailing List mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2015/05/31/2

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/74914

Exploit mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2015/05/29/1

Scores

EPSS 0.0115

EPSS Percentile 63.0%

Details

CWE

CWE-352

Status published

Products (1)

wp_smiley_project/wp_smiley 1.4.1

Published Jun 18, 2015

Tracked Since Feb 18, 2026