Skip to content
OpenAdvisories

Vendor

indieweb

2 known vulnerabilities.

Products

IndieWeb 1 IndieAuth 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.8
    CVE-2025-12028 Public exploit

    IndieAuth <= 4.5.4 - Cross-Site Request Forgery to Account Takeover via Stolen OAuth Tokens

    The IndieAuth plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4. This is due to missing nonce verification on the `login_form_indieauth()` function and the authorization endpoint at wp-login.php?actio…

    indieweb IndieAuth Web / CMS