What is the CVSS score of EUVD-2026-14007?

EUVD-2026-14007 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Google are affected by EUVD-2026-14007?

Organizations using for WordPress is vulnerable to Cross-Site Request Forgery in all should be aware of moderate risk from CVE-2026-1393, a cross-site request forgery vulnerability rated CVSS 4.3.

How to fix or mitigate EUVD-2026-14007?

Within 30 days: Identify affected systems running for WordPress is vulnerable to Cross-Site Request Forgery in and apply vendor patches as part of regular patch cycle. Verify anti-CSRF tokens are enforced.

Google EUVD-2026-14007

| CVE-2026-1393 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-03-21 Wordfence

GHSA-r65q-93p5-8cff

Google WordPress CSRF

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14007

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

MEDIUM 4.3

DescriptionCVE.org

The Add Google Social Profiles to Knowledge Graph Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on the settings update functionality. This makes it possible for unauthenticated attackers to update the plugin's Knowledge Graph settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AnalysisAI

The Add Google Social Profiles to Knowledge Graph Box WordPress plugin (all versions up to 1.0) contains a Cross-Site Request Forgery (CSRF) vulnerability due to missing nonce validation on its settings update functionality. An unauthenticated attacker can forge malicious requests to modify the plugin's Knowledge Graph settings if they can trick a site administrator into clicking a malicious link. While the CVSS score of 4.3 is moderate, the attack requires user interaction and has no confidentiality impact, making it a lower-severity real-world threat despite being easily exploitable.

Technical ContextAI

This vulnerability stems from a CSRF weakness (CWE-352) in the WordPress plugin's settings handling mechanism. The plugin fails to implement WordPress nonce validation—a cryptographic token mechanism that WordPress provides to prevent CSRF attacks. The affected code is located in gsp-options.php (line 10 as referenced in the plugin's source repository), where the settings update functionality processes POST requests without verifying the nonce via wp_verify_nonce() or similar protective measures. The CPE identifier (cpe:2.3:a:omarnas:add_google_social_profiles_to_knowledge_graph_box) confirms this affects the vendor omarnas's Knowledge Graph plugin across all versions up to 1.0. CSRF vulnerabilities are particularly dangerous in WordPress admin contexts because authenticated administrators are frequently browsing external sites, making them susceptible to forged requests originating from attacker-controlled domains.

RemediationAI

Site administrators should immediately upgrade the Add Google Social Profiles to Knowledge Graph Box plugin to a patched version when released by the vendor omarnas, checking the official WordPress plugin repository and vendor advisory (linked via Wordfence at https://www.wordfence.com/threat-intel/vulnerabilities/id/19339b9f-8242-44a5-8239-7ef347ffbaad) for patch availability. Until a fix is released, apply WordPress security best practices: restrict admin panel access via firewall rules or Web Application Firewall (WAF) to trusted IP ranges, disable the vulnerable plugin if not critical to operations, educate administrators about phishing and malicious links, and monitor admin settings changes via WordPress security plugins or audit logs. Additionally, consider implementing Content Security Policy (CSP) headers and X-Frame-Options to mitigate CSRF vector effectiveness site-wide.