{"id":"CVE-2023-25989","aliases":["EUVD-2023-29876","GHSA-m9vg-3mw3-9gwh"],"status":"published","title":"Cross-Site Request Forgery (CSRF) vulnerability in multiple WordPress plugins by Meks","description":"Cross-Site Request Forgery (CSRF) vulnerability in Meks Video Importer, Meks Time Ago, Meks ThemeForest Smart Widget, Meks Smart Author Widget, Meks Audio Player, Meks Easy Maps, Meks Easy Photo Feed Widget, Meks Simple Flickr Widget, Meks Easy Ads Widget, Meks Smart Social Widget plugins leading to dismiss or the popup.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00444,"percentile":0.39058,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-352"],"published":"2023-10-03T11:00:33Z","modified":"2026-06-17T05:42:26Z","products":[{"vendor":"meks","product":"meks audio player"},{"vendor":"meks","product":"meks easy ads widget"},{"vendor":"meks","product":"meks easy maps"},{"vendor":"meks","product":"meks easy photo feed widget"},{"vendor":"meks","product":"meks simple flickr widget"},{"vendor":"meks","product":"meks smart author widget"},{"vendor":"meks","product":"meks smart social widget"},{"vendor":"meks","product":"meks themeforest smart widget"},{"vendor":"meks","product":"meks time ago"},{"vendor":"meks","product":"meks video importer"},{"vendor":"mekshq","product":"meks easy maps"},{"vendor":"mekshq","product":"meks smart social widget"},{"vendor":"mekshq","product":"meks video importer"},{"vendor":"mekshq","product":"meks_audio_player"},{"vendor":"mekshq","product":"meks_easy_ads_widget"},{"vendor":"mekshq","product":"meks_easy_maps"},{"vendor":"mekshq","product":"meks_easy_photo_feed_widget"},{"vendor":"mekshq","product":"meks_simple_flickr_widget"},{"vendor":"mekshq","product":"meks_smart_author_widget"},{"vendor":"mekshq","product":"meks_smart_social_widget"},{"vendor":"mekshq","product":"meks_themeforest_smart_widget"},{"vendor":"mekshq","product":"meks_time_ago"},{"vendor":"mekshq","product":"meks_video_importer"}],"references":[{"url":"https://patchstack.com/database/vulnerability/meks-video-importer/wordpress-meks-video-importer-plugin-1-0-10-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","tags":["vdb-entry","x_transferred","Third Party Advisory"]},{"url":"https://patchstack.com/database/vulnerability/meks-time-ago/wordpress-meks-time-ago-plugin-1-1-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","tags":["vdb-entry","x_transferred","Third Party Advisory"]},{"url":"https://patchstack.com/database/vulnerability/meks-themeforest-smart-widget/wordpress-meks-themeforest-smart-widget-plugin-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","tags":["vdb-entry","x_transferred","Third Party Advisory"]},{"url":"https://patchstack.com/database/vulnerability/meks-smart-author-widget/wordpress-meks-smart-author-widget-plugin-1-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","tags":["vdb-entry","x_transferred","Third Party Advisory"]},{"url":"https://patchstack.com/database/vulnerability/meks-audio-player/wordpress-meks-audio-player-plugin-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","tags":["vdb-entry","x_transferred","Third Party Advisory"]},{"url":"https://patchstack.com/database/vulnerability/meks-easy-maps/wordpress-meks-easy-maps-plugin-2-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","tags":["vdb-entry","x_transferred","Third Party Advisory"]},{"url":"https://patchstack.com/database/vulnerability/meks-easy-instagram-widget/wordpress-meks-easy-photo-feed-widget-plugin-1-2-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","tags":["vdb-entry","x_transferred","Third Party Advisory"]},{"url":"https://patchstack.com/database/vulnerability/meks-simple-flickr-widget/wordpress-meks-simple-flickr-widget-plugin-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","tags":["vdb-entry","x_transferred","Third Party Advisory"]},{"url":"https://patchstack.com/database/vulnerability/meks-easy-ads-widget/wordpress-meks-easy-ads-widget-plugin-2-0-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","tags":["vdb-entry","x_transferred","Third Party Advisory"]},{"url":"https://patchstack.com/database/vulnerability/meks-smart-social-widget/wordpress-meks-smart-social-widget-plugin-1-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","tags":["vdb-entry","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25989"},{"url":"https://github.com/advisories/GHSA-m9vg-3mw3-9gwh"}],"sources":{"cve":[{"id":"CVE-2023-25989","title":"Cross-Site Request Forgery (CSRF) vulnerability in multiple WordPress plugins by Meks","description":"Cross-Site Request Forgery (CSRF) vulnerability in Meks Video Importer, Meks Time Ago, Meks ThemeForest Smart Widget, Meks Smart Author Widget, Meks Audio Player, Meks Easy Maps, Meks Easy Photo Feed Widget, Meks Simple Flickr Widget, Meks Easy Ads Widget, Meks Smart Social Widget plugins leading to dismiss or the popup.","status":"published","published":"2023-10-03T11:00:33.837Z","modified":"2026-04-28T16:08:11.292Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:35:19.559321Z"}],"euvd":[{"id":"EUVD-2023-29876","description":"Cross-Site Request Forgery (CSRF) vulnerability in Meks Video Importer, Meks Time Ago, Meks ThemeForest Smart Widget, Meks Smart Author Widget, Meks Audio Player, Meks Easy Maps, Meks Easy Photo Feed Widget, Meks Simple Flickr Widget, Meks Easy Ads Widget, Meks Smart Social Widget plugins leading to dismiss or the popup.","status":"published","published":"2023-10-03T11:00:33Z","modified":"2026-04-28T16:08:11Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:10.909258Z"}],"ghsa":[{"id":"GHSA-m9vg-3mw3-9gwh","title":"Cross-Site Request Forgery (CSRF) vulnerability in Meks Video Importer, Meks Time Ago, Meks...","description":"Cross-Site Request Forgery (CSRF) vulnerability in Meks Video Importer, Meks Time Ago, Meks ThemeForest Smart Widget, Meks Smart Author Widget, Meks Audio Player, Meks Easy Maps, Meks Easy Photo Feed Widget, Meks Simple Flickr Widget, Meks Easy Ads Widget, Meks Smart Social Widget plugins leading to dismiss or the popup.","status":"published","published":"2023-10-03T12:30:20Z","modified":"2024-04-04T08:07:06Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:56:57.02573Z"}],"nvd":[{"id":"CVE-2023-25989","description":"Cross-Site Request Forgery (CSRF) vulnerability in Meks Video Importer, Meks Time Ago, Meks ThemeForest Smart Widget, Meks Smart Author Widget, Meks Audio Player, Meks Easy Maps, Meks Easy Photo Feed Widget, Meks Simple Flickr Widget, Meks Easy Ads Widget, Meks Smart Social Widget plugins leading to dismiss or the popup.","status":"published","published":"2023-10-03T12:15:10.243Z","modified":"2026-06-17T05:42:26.137Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:08:35.022405Z"}]}}