CVE-2023-3320

The WP Sticky Social plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. This is due to missing nonce validation in the ~/admin/views/admin.php file. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• http://packetstormsecurity.com/files/173048/WordPress-WP-Sticky-Social-1.0.1-CSRF-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2926150%40wp-sticky-social&new=2926150%40wp-sticky-socialPatch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a272e12b-97a2-421a-a703-3acce2ed8313?source=cveThird Party Advisory
• http://packetstormsecurity.com/files/173048/WordPress-WP-Sticky-Social-1.0.1-CSRF-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2926150%40wp-sticky-social&new=2926150%40wp-sticky-socialPatch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a272e12b-97a2-421a-a703-3acce2ed8313?source=cveThird Party Advisory

Published

Jun 20, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-33194Craft is a CMS for creating custom digital experiences on th…4.8
• CVE-2023-33195Craft is a CMS for creating custom digital experiences on th…6.1
• CVE-2023-33196Craft is a CMS for creating custom digital experiences. Cros…5.4
• CVE-2023-33197Craft is a CMS for creating custom digital experiences on th…5.4
• CVE-2023-33198tgstation-server is a production scale tool for BYOND server…7.5
• CVE-2023-33199Rekor's goals are to provide an immutable tamper resistant l…5.3
• CVE-2023-33200A local non-privileged user can make improper GPU processing…4.7
• CVE-2023-33201Bouncy Castle For Java before 1.74 is affected by an LDAP in…5.3
• CVE-2023-33202Bouncy Castle for Java before 1.73 contains a potential Deni…5.5
• CVE-2023-33203The Linux kernel before 6.2.9 has a race condition and resul…6.4
• CVE-2023-33204sysstat through 12.7.2 allows a multiplication integer overf…7.8
• CVE-2023-33206Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR…6.8