What’s Vulnerable › Vulnerabilities

CVE-2024-3472: Modal Window < 5.3.10 - Modal Deletion via CSRF

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-05-02 · updated 2026-06-17
• Weakness: CWE-352

Description

The Modal Window WordPress plugin before 5.3.10 does not have CSRF check in place when bulk deleting modals, which could allow attackers to make a logged in admin delete them via a CSRF attack

Affected products

• wpcalc Modal Window – create popup modal window: before 5.3.10 — fixed in 5.3.10

How to fix

Upgrade to a fixed version: wpcalc Modal Window – create popup modal window 5.3.10. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/d42f74dd-520f-40aa-9cf0-3544db9562c7/
• https://wpscan.com/vulnerability/d42f74dd-520f-40aa-9cf0-3544db9562c7/

Get alerted when CVE-2024-3472 or the next vulnerability affects your stack