EIP-2026-114071
PRE-CVEWordPress Plugin Social Media Widget by Acurax 3.2.5 - Cross-Site Request Forgery
Title source: legacyExploitation Summary
EIP tracks 1 public exploit for EIP-2026-114071. PoCs published by Panagiotis Vagenas.
AI-analyzed exploit summary This exploit demonstrates a CSRF vulnerability in the Social Media Widget by Acurax (version 3.2.5) that allows an attacker to perform a persistent XSS attack by manipulating the `recordsArray` parameter. The vulnerability arises due to the lack of anti-CSRF controls in the `acx_asmw_saveorder_callback` function.
Description
WordPress Plugin Social Media Widget by Acurax 3.2.5 - Cross-Site Request Forgery
Exploits (1)
This exploit demonstrates a CSRF vulnerability in the Social Media Widget by Acurax (version 3.2.5) that allows an attacker to perform a persistent XSS attack by manipulating the `recordsArray` parameter. The vulnerability arises due to the lack of anti-CSRF controls in the `acx_asmw_saveorder_callback` function.