CVE-2012-4921

medium

Published 2014-04-10 · Modified 2026-05-06

CVSS v3

—

CVSS v2

6.8

VIR risk

6.8

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in the DVS Custom Notification plugin 1.0.1 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change application settings or (2) conduct cross-site scripting (XSS) attacks.

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: PSIRT-CNA@flexerasoftware.com — http://secunia.com/advisories/51531

Application impact

Vendor	Product	Versions	Fixed
dvs_custom_notification_project	dvs_custom_notification	`1.0.1`

References

http://osvdb.org/89441
http://secunia.com/advisories/51531
http://osvdb.org/89441
http://secunia.com/advisories/51531

CWEs

CWE-352

Verify integrity in audit chain (admin only). AS-IS.