CVE-2014-5347

Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin before 2.76 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) disqus_replace, (2) disqus_public_key, or (3) disqus_secret_key parameter to wp-admin/edit-comments.php in manage.php or that (4) reset or (5) delete plugin options via the reset parameter to wp-admin/edit-comments.php.

• disqus disqus comment system (<= 2.75) • disqus disqus comment system 2.40 • disqus disqus comment system 2.41 • disqus disqus comment system 2.42 • disqus disqus comment system 2.43 • disqus disqus comment system 2.44 • disqus disqus comment system 2.45 • disqus disqus comment system 2.46 • disqus disqus comment system 2.47 • disqus disqus comment system 2.48 • disqus disqus comment system 2.49 • disqus disqus comment system 2.50 • disqus disqus comment system 2.51 • disqus disqus comment system 2.52 • disqus disqus comment system 2.53 • disqus disqus comment system 2.54 • disqus disqus comment system 2.55 • disqus disqus comment system 2.60 • disqus disqus comment system 2.61 • disqus disqus comment system 2.62 • disqus disqus comment system 2.63 • disqus disqus comment system 2.64 • disqus disqus comment system 2.65 • disqus disqus comment system 2.66 • disqus disqus comment system 2.67 • disqus disqus comment system 2.68 • disqus disqus comment system 2.69 • disqus disqus comment system 2.70 • disqus disqus comment system 2.71 • disqus disqus comment system 2.72 • disqus disqus comment system 2.73 • disqus disqus comment system 2.74