CVE-2020-36739: slickremix feed_them_social Cross-Site Request Forgery (CSRF)

EPSS trend

Probability

0.48%

Chance of exploitation in the next 30 days

Percentile

40%

Versus all other CVEs

30-day change

0.00 pp

From 0.48% on 20-09-2026

20-09-202620-10-2026

EPSS score

0.48%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

referenceUnverified
Exploit Reference (blog.nintechnet.com)
Maturity: unknown

References

10 links

www.wordfence.com/threat-intel/vulnerabilities/id/1fcbe3d1-449c-4135-bbf5-9ea9236e5328?source=cveThird Party Advisory
blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/ExploitTechnical DescriptionThird Party Advisory
blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/Not Applicable
blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/Not Applicable
blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/Not Applicable
blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/Not Applicable
blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/Not Applicable
blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/Not Applicable
plugins.trac.wordpress.org/changesetPatch
www.wordfence.com/threat-intel/vulnerabilities/id/1fcbe3d1-449c-4135-bbf5-9ea9236e5328Vendor Advisory

Related vulnerabilities

CVE-2022-2942wordpressfeed-them-social3y ago14-11-2022 00:00The Feed Them Social plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.9.9. This is due to missing or incorrect nonce validation on various functions such as fts_instagram_token_ajax(). This makes it possible for unauthenticated attackers to trigger settings updates via forged request granted they can trick a site administrator into performing an action such as clicking on a link.CVE-2022-2940wordpressfeed-them-social3y ago14-11-2022 00:00The Feed Them Social plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘access_token’ parameter in the function fts_instagram_token_ajax in versions up to, and including, 2.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, subscriber and above, to inject arbitrary web scripts stored in the plugin options.CVE-2015-9351slickremixfeed_them_social+12.76%7y ago27-08-2019 12:01The feed-them-social plugin before 1.7.0 for WordPress has possible shortcode execution in the Facebook Feeds load more button.CVE-2015-9350slickremixfeed_them_social+10.91%7y ago27-08-2019 12:02The feed-them-social plugin before 1.7.0 for WordPress has reflected XSS in the Facebook Feeds load more button.CVE-2022-2532slickremixfeed_them_social+20.78%4y ago22-08-2022 15:03The Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting CVE-2022-2383slickremixfeed_them_social+26.01%4y ago22-08-2022 15:02The Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting

All vulnerabilities infeed_them_social feed them social – social media feeds, video, and photo galleries

CVE-2020-36739: slickremix feed_them_social Cross-Site Request Forgery (CSRF)

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References