CVE-2014-9335 DandyID Services <= 1.5.9 - Cross-Site Request Forgery

MediumCVSS 6.8 EPSS 1.0%

Published: 2014-12-19 17:00
Updated: 2026-06-17 03:18
Exploit status: No public exploit known

Description

Multiple cross-site request forgery (CSRF) vulnerabilities in the DandyID Services plugin 1.5.9 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) email_address or (2) sidebarTitle parameter in the dandyid-services.php page to wp-admin/options-general.php.

Affected products

Product	Affected versions	Fixed in
dandyid services project dandyid services	<= 1.5.9	No fix listed
wordpress dandyid-services(WordPress)	<= 1.5.9	No fix listed

References

packetstormsecurity.com exploit
dandyidservice-wp-dandyidservice-xss(99502) vdb-entry
Wordfence Intelligence third-party-advisory
www.cve.org

CVSS v2.0

6.8 Medium

AV:N/AC:M/Au:N/C:P/I:P/A:P

Access Vector: Network
Access Complexity: Medium
Authentication: None
Confidentiality: Partial
Integrity: Partial
Availability: Partial

All scores (2)

v3.1 6.1 · wordfence
v2.0 6.8 · nvd@nist.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 1.02% (percentile 63.7)
CWE: CWE-352 Cross-Site Request Forgery

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.