CVE-2015-9434

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-09-26 · updated 2026-06-17
Weakness: CWE-352

Description

The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=kwlogos&page=kwlogos_settings tab or tab_flags_order parameter.

Affected products

Kiwi-Logo-Carousel Project Kiwi-Logo-Carousel: before 1.7.2 — fixed in 1.7.2

How to fix

Upgrade to a fixed version: Kiwi-Logo-Carousel Project Kiwi-Logo-Carousel 1.7.2. Check the vendor advisory for mitigations.

References

http://cinu.pl/research/wp-plugins/mail_3764bb40db5ed12aac2c7812d7544730.html
https://wordpress.org/plugins/kiwi-logo-carousel/#developers
https://wpvulndb.com/vulnerabilities/8290
http://cinu.pl/research/wp-plugins/mail_3764bb40db5ed12aac2c7812d7544730.html
https://wordpress.org/plugins/kiwi-logo-carousel/#developers
https://wpvulndb.com/vulnerabilities/8290

Get alerted when CVE-2015-9434 or the next vulnerability affects your stack