Jetstylemanager For Gutenberg
Monthly
Cross-site request forgery vulnerabilities in JetStyleManager for Gutenberg WordPress plugin (all versions before 1.3.9) allow an unauthenticated attacker to delete or modify custom widget skins by tricking a logged-in Contributor-level (or higher) user into visiting a crafted page or clicking a malicious link. The missing CSRF token (nonce) validation on affected AJAX endpoints means the victim's authenticated browser session is silently weaponized against their own site. A publicly available exploit exists via WPScan and vendor-released patch version 1.3.9 resolves the issue.
Cross-site request forgery vulnerabilities in JetStyleManager for Gutenberg WordPress plugin (all versions before 1.3.9) allow an unauthenticated attacker to delete or modify custom widget skins by tricking a logged-in Contributor-level (or higher) user into visiting a crafted page or clicking a malicious link. The missing CSRF token (nonce) validation on affected AJAX endpoints means the victim's authenticated browser session is silently weaponized against their own site. A publicly available exploit exists via WPScan and vendor-released patch version 1.3.9 resolves the issue.