CVE-2015-9432: thealpinepress alpine-photo-tile-for-instagram Cross-Site Request Forgery (CSRF)
Vulnerability summary
CVE-2015-9432 is a medium (CVSS 6.5) Cross-Site Request Forgery (CSRF) vulnerability in thealpinepress alpine-photo-tile-for-instagram. EPSS estimates a 0.87% chance of exploitation in the next 30 days, higher than 58% of scored vulnerabilities. 2 public exploits are recorded. Fixed in 1.2.7.6.
Timeline
- 26-09-2019PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The alpine-photo-tile-for-instagram plugin before 1.2.7.6 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=alpine-photo-tile-for-instagram-settings tab parameter.
CVSS metrics
3 scores · 2 sources · 2 versions- wordfenceSource6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NDiffers
EPSS trend
Probability
0.87%
Chance of exploitation in the next 30 days
Percentile
58%
Versus all other CVEs
30-day change
0.00 pp
From 0.87% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (wpvulndb.com)
Maturity: unknown
Exploit Reference (cinu.pl)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Affected systems
Thealpinepress1 product
- alpine-photo-tile-for-instagram< 1.2.7.6
Wordpress1 product
- alpine-photo-tile-for-instagram< 1.2.7.6
2 vendors · 2 products
References
4 links- cinu.pl/research/wp-plugins/mail_8af3902b4f3a5d06304937c7eab1ee35.htmlX Refsource MISCExploitThird Party Advisory