Indieweb vulnerabilities
We track 1 vulnerability in Indieweb products. 1 is rated high or critical, and none are known to be exploited. The most recent was published on October 24, 2025.
1vulnerabilities
0critical
1high
0exploited
8.8average CVSS score
Latest Indieweb vulnerabilities
- 8.8 High severity
IndieAuth: Cross-Site Request Forgery
The IndieAuth plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.5.4. This is due to missing nonce verification on the `login_form_indieauth()` function and the authorization endpoint at wp-login.php?action