Cross-Site Request Forgery (CSRF) vulnerability in multiple WordPress plugins by Meks
Priority LOW 38CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Tampering
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352.
Summary
Cross-Site Request Forgery (CSRF) vulnerability in Meks Video Importer, Meks Time Ago, Meks ThemeForest Smart Widget, Meks Smart Author Widget, Meks Audio Player, Meks Easy Maps, Meks Easy Photo Feed Widget, Meks Simple Flickr Widget, Meks Easy Ads Widget, Meks Smart Social Widget plugins leading to dismiss or the popup.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00444 38th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Meks | Meks Video Importer | up to 1.0.10 | — | No fix listed | CNA |
| Meks | Meks Time Ago | up to 1.1.6 | — | No fix listed | CNA |
| Meks | Meks ThemeForest Smart Widget | up to 1.4 | — | No fix listed | CNA |
| Meks | Meks Smart Author Widget | up to 1.1.3 | — | No fix listed | CNA |
| Meks | Meks Audio Player | up to 1.2 | — | No fix listed | CNA |
| Meks | Meks Easy Maps | up to 2.1.3 | — | No fix listed | CNA |
| Meks | Meks Easy Photo Feed Widget | up to 1.2.7 | — | No fix listed | CNA |
| Meks | Meks Simple Flickr Widget | up to 1.2 | — | No fix listed | CNA |
| Meks | Meks Easy Ads Widget | up to 2.0.7 | — | No fix listed | CNA |
| Meks | Meks Smart Social Widget | up to 1.6 | — | No fix listed | CNA |
- Meks Video Importer VendorMeks Affected up to 1.0.10 Fixed in — No fix listed CNA
- Meks Time Ago VendorMeks Affected up to 1.1.6 Fixed in — No fix listed CNA
- Meks ThemeForest Smart Widget VendorMeks Affected up to 1.4 Fixed in — No fix listed CNA
- Meks Smart Author Widget VendorMeks Affected up to 1.1.3 Fixed in — No fix listed CNA
- Meks Audio Player VendorMeks Affected up to 1.2 Fixed in — No fix listed CNA
- Meks Easy Maps VendorMeks Affected up to 2.1.3 Fixed in — No fix listed CNA
- Meks Easy Photo Feed Widget VendorMeks Affected up to 1.2.7 Fixed in — No fix listed CNA
- Meks Simple Flickr Widget VendorMeks Affected up to 1.2 Fixed in — No fix listed CNA
- Meks Easy Ads Widget VendorMeks Affected up to 2.0.7 Fixed in — No fix listed CNA
- Meks Smart Social Widget VendorMeks Affected up to 1.6 Fixed in — No fix listed CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mekshq:meks_audio_player:*:*:*:*:*:wordpress:*:* | up to 1.2 | Vulnerable | Meks |
| cpe:2.3:a:mekshq:meks_easy_ads_widget:*:*:*:*:*:wordpress:*:* | up to 2.0.7 | Vulnerable | Meks |
| cpe:2.3:a:mekshq:meks_easy_maps:*:*:*:*:*:wordpress:*:* | up to 2.1.3 | Vulnerable | Meks |
| cpe:2.3:a:mekshq:meks_easy_photo_feed_widget:*:*:*:*:*:wordpress:*:* | up to 1.2.7 | Vulnerable | Meks |
| cpe:2.3:a:mekshq:meks_simple_flickr_widget:*:*:*:*:*:wordpress:*:* | up to 1.2 | Vulnerable | Meks |
| cpe:2.3:a:mekshq:meks_smart_author_widget:*:*:*:*:*:wordpress:*:* | up to 1.1.3 | Vulnerable | Meks |
| cpe:2.3:a:mekshq:meks_smart_social_widget:*:*:*:*:*:wordpress:*:* | up to 1.6 | Vulnerable | Meks |
| cpe:2.3:a:mekshq:meks_themeforest_smart_widget:*:*:*:*:*:wordpress:*:* | up to 1.4 | Vulnerable | Meks |
| cpe:2.3:a:mekshq:meks_time_ago:*:*:*:*:*:wordpress:*:* | up to 1.1.6 | Vulnerable | Meks |
| cpe:2.3:a:mekshq:meks_video_importer:*:*:*:*:*:wordpress:*:* | up to 1.0.10 | Vulnerable | Meks |
- cpe:2.3:a:mekshq:meks_audio_player:*:*:*:*:*:wordpress:*:* Versions up to 1.2 Vulnerable ·Meks
- cpe:2.3:a:mekshq:meks_easy_ads_widget:*:*:*:*:*:wordpress:*:* Versions up to 2.0.7 Vulnerable ·Meks
- cpe:2.3:a:mekshq:meks_easy_maps:*:*:*:*:*:wordpress:*:* Versions up to 2.1.3 Vulnerable ·Meks
- cpe:2.3:a:mekshq:meks_easy_photo_feed_widget:*:*:*:*:*:wordpress:*:* Versions up to 1.2.7 Vulnerable ·Meks
- cpe:2.3:a:mekshq:meks_simple_flickr_widget:*:*:*:*:*:wordpress:*:* Versions up to 1.2 Vulnerable ·Meks
- cpe:2.3:a:mekshq:meks_smart_author_widget:*:*:*:*:*:wordpress:*:* Versions up to 1.1.3 Vulnerable ·Meks
- cpe:2.3:a:mekshq:meks_smart_social_widget:*:*:*:*:*:wordpress:*:* Versions up to 1.6 Vulnerable ·Meks
- cpe:2.3:a:mekshq:meks_themeforest_smart_widget:*:*:*:*:*:wordpress:*:* Versions up to 1.4 Vulnerable ·Meks
- cpe:2.3:a:mekshq:meks_time_ago:*:*:*:*:*:wordpress:*:* Versions up to 1.1.6 Vulnerable ·Meks
- cpe:2.3:a:mekshq:meks_video_importer:*:*:*:*:*:wordpress:*:* Versions up to 1.0.10 Vulnerable ·Meks
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-25989
- 2026-10-03 Alias added: GHSA-m9vg-3mw3-9gwh
References
Advisory 10
- https://patchstack.com/database/vulnerability/meks-video-importer/wordpress-meks-video-importer-plugin-1-0-10-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
- https://patchstack.com/database/vulnerability/meks-time-ago/wordpress-meks-time-ago-plugin-1-1-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
- https://patchstack.com/database/vulnerability/meks-themeforest-smart-widget/wordpress-meks-themeforest-smart-widget-plugin-1-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
- https://patchstack.com/database/vulnerability/meks-smart-author-widget/wordpress-meks-smart-author-widget-plugin-1-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
- https://patchstack.com/database/vulnerability/meks-audio-player/wordpress-meks-audio-player-plugin-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
- https://patchstack.com/database/vulnerability/meks-easy-maps/wordpress-meks-easy-maps-plugin-2-1-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
- https://patchstack.com/database/vulnerability/meks-easy-instagram-widget/wordpress-meks-easy-photo-feed-widget-plugin-1-2-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
- https://patchstack.com/database/vulnerability/meks-simple-flickr-widget/wordpress-meks-simple-flickr-widget-plugin-1-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
- https://patchstack.com/database/vulnerability/meks-easy-ads-widget/wordpress-meks-easy-ads-widget-plugin-2-0-7-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
- https://patchstack.com/database/vulnerability/meks-smart-social-widget/wordpress-meks-smart-social-widget-plugin-1-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
Sources
- CVE-2023-25989 · CVE Program
- CVE-2023-25989 · NVD
- FIRST EPSS
- GHSA-m9vg-3mw3-9gwh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences