EUVD-2026-14007
GHSA-r65q-93p5-8cff
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Add Google Social Profiles to Knowledge Graph Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to update the plugin's Knowledge Graph settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
AnalysisAI
The Add Google Social Profiles to Knowledge Graph Box WordPress plugin (all versions up to 1.0) contains a Cross-Site Request Forgery (CSRF) vulnerability due to missing nonce validation on its settings update functionality. An unauthenticated attacker can forge malicious requests to modify the plugin's Knowledge Graph settings if they can trick a site administrator into clicking a malicious link. While the CVSS score of 4.3 is moderate, the attack requires user interaction and has no confidentiality impact, making it a lower-severity real-world threat despite being easily exploitable.
Technical ContextAI
This vulnerability stems from a CSRF weakness (CWE-352) in the WordPress plugin's settings handling mechanism. The plugin fails to implement WordPress nonce validation—a cryptographic token mechanism that WordPress provides to prevent CSRF attacks. The affected code is located in gsp-options.php (line 10 as referenced in the plugin's source repository), where the settings update functionality processes POST requests without verifying the nonce via wp_verify_nonce() or similar protective measures. The CPE identifier (cpe:2.3:a:omarnas:add_google_social_profiles_to_knowledge_graph_box) confirms this affects the vendor omarnas's Knowledge Graph plugin across all versions up to 1.0. CSRF vulnerabilities are particularly dangerous in WordPress admin contexts because authenticated administrators are frequently browsing external sites, making them susceptible to forged requests originating from attacker-controlled domains.
RemediationAI
Site administrators should immediately upgrade the Add Google Social Profiles to Knowledge Graph Box plugin to a patched version when released by the vendor omarnas, checking the official WordPress plugin repository and vendor advisory (linked via Wordfence at https://www.wordfence.com/threat-intel/vulnerabilities/id/19339b9f-8242-44a5-8239-7ef347ffbaad) for patch availability. Until a fix is released, apply WordPress security best practices: restrict admin panel access via firewall rules or Web Application Firewall (WAF) to trusted IP ranges, disable the vulnerable plugin if not critical to operations, educate administrators about phishing and malicious links, and monitor admin settings changes via WordPress security plugins or audit logs. Additionally, consider implementing Content Security Policy (CSP) headers and X-Frame-Options to mitigate CSRF vector effectiveness site-wide.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today