CVE-2013-3257: Cross-site request forgery (CSRF) vulnerability in the Related Posts plugin before 2.7.2 for WordPress allows remote attackers to hijack the authentication of users for requests that modify settings v

medium Affects related-posts (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2014-06-02; advisory modified 2026-06-16.

Cross-site request forgery (CSRF) vulnerability in the Related Posts plugin before 2.7.2 for WordPress allows remote attackers to hijack the authentication of users for requests that modify settings v

Package: related-posts (WordPress plugin) WordPress
Affected versions: <=2.7.1 or =1.0 or =1.1 or =1.2 or =1.3 or =1.3.1 or =1.3.2 or =1.3.3 or =1.4 or =1.5 or =1.6 or =1.7 or =1.8 or =1.8.1 or =2.3 or =2.4.1 or =2.5.1 or =2.6 or =2.7
Fixed in: no fix recorded
Severity: medium CVSS 6.8
Exploitation: not on CISA KEV · EPSS 1% (64.7th percentile)
Published: 2014-06-02
Source: nvd

References

CWE-352

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2015-9361 medium The Related Posts plugin before 1.8.2 for WordPress has XSS via add_query_arg() and remove same package: related-posts (WordPress plugin)
CVE-2021-24482 medium The Related Posts for WordPress plugin through 2.0.4 does not sanitise its heading_text an same package: related-posts (WordPress plugin)
CVE-2021-24180 medium Unvalidated input and lack of output encoding within the Related Posts for WordPress plugi same package: related-posts (WordPress plugin)
CVE-2019-9787 high WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Ex same weakness: CWE-352
CVE-2016-6897 medium Cross-site request forgery (CSRF) vulnerability in the wp_ajax_update_plugin function in w same weakness: CWE-352
CVE-2022-1020 critical The Product Table for WooCommerce (wooproducttable) WordPress plugin before 3.1.2 does not same weakness: CWE-352