CVE-2015-5483

Multiple cross-site request forgery (CSRF) vulnerabilities in the Private Only plugin 3.5.1 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) add users, (2) delete posts, or (3) modify PHP files via unspecified vectors, or (4) conduct cross-site scripting (XSS) attacks via the po_logo parameter in the privateonly.php page to wp-admin/options-general.php.

• CWE-352

• http://packetstormsecurity.com/files/133349/WordPress-Private-Only-3.5.1-CSRF-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2015/Aug/77Exploit, Mailing List, Third Party Advisory
• https://security.dxw.com/advisories/csrfxss-vulnerability-in-private-only-could-allow-an-attacker-to-do-almost-anything-an-admin-user-can/Exploit, Third Party Advisory
• http://packetstormsecurity.com/files/133349/WordPress-Private-Only-3.5.1-CSRF-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2015/Aug/77Exploit, Mailing List, Third Party Advisory
• https://security.dxw.com/advisories/csrfxss-vulnerability-in-private-only-could-allow-an-attacker-to-do-almost-anything-an-admin-user-can/Exploit, Third Party Advisory

Published

Jan 28, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-5474BitTorrent and uTorrent allow remote attackers to inject com…
• CVE-2015-5475Multiple cross-site scripting (XSS) vulnerabilities in Reque…
• CVE-2015-5477named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10…
• CVE-2015-5479The ff_h263_decode_mba function in libavcodec/ituh263dec.c i…
• CVE-2015-5481Cross-site scripting (XSS) vulnerability in forms/panels.php…
• CVE-2015-5482Directory traversal vulnerability in the GD bbPress Attachme…
• CVE-2015-5484Cross-site scripting (XSS) vulnerability in the Plotly plugi…5.4
• CVE-2015-5485Cross-site scripting (XSS) vulnerability in the Event Import…
• CVE-2015-5487Cross-site scripting (XSS) vulnerability in the Camtasia Rel…
• CVE-2015-5488Cross-site scripting (XSS) vulnerability in the MailChimp Si…
• CVE-2015-5489Cross-site scripting (XSS) vulnerability in the Smart Trim m…
• CVE-2015-5490The _views_fetch_data method in includes/cache.inc in the Vi…