CVE-2023-5884 (published 2023-12-04T21:29:32.963Z)
The Word Balloon WordPress plugin before 4.20.3 does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to trick a logged in user to delete arbitrary avatars by clicking a link.
Affected products: Vendor: Unknown
Product: Word Balloon
Versions: 0