{"id":"CVE-2026-121770","kind":"vulnerability","aliases":["CVE-2026-121770"],"related":[],"title":"VISeek WordPress plugin: CSRF flaw lets attackers trigger unwanted admin actions","description":"Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme VISeek viseek-easy-custom-search allows Cross Site Request Forgery.This issue affects VISeek: from n/a through 1.0.5.","summary":"The VISeek Easy Custom Search WordPress plugin, by VillaTheme, has a cross-site request forgery flaw in versions through 1.0.5. An attacker can make a logged-in user's browser send requests the user did not intend, such as changing plugin settings.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"viseek-easy-custom-search","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["package","viseek-easy-custom-search","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the VISeek Easy Custom Search plugin (viseek-easy-custom-search) in the WordPress admin plugin list.\n- Confirm whether the installed version is `1.0.5` or earlier.","fix":null,"status":"open","published_at":"2026-11-11T12:19:35+00:00","first_seen_at":"2026-11-11T12:27:10+00:00","triaged_at":"2026-11-11T12:28:44+00:00","updated_at":"2026-11-11T12:28:44+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-11T12:28:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"VISeek WordPress plugin: CSRF flaw lets attackers trigger unwanted admin actions","impact":"medium","summary":"The VISeek Easy Custom Search WordPress plugin, by VillaTheme, has a cross-site request forgery flaw in versions through 1.0.5. An attacker can make a logged-in user's browser send requests the user did not intend, such as changing plugin settings.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","viseek-easy-custom-search"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Logged-in admin actions are performed without consent via forged requests","analyst_note":"Confirm the fixed version and the vulnerable functions from the NVD entry or the Wordfence/vendor advisory; the sources give only 'through 1.0.5'.","how_to_check":"- Check the installed version of the VISeek Easy Custom Search plugin (viseek-easy-custom-search) in the WordPress admin plugin list.\n- Confirm whether the installed version is `1.0.5` or earlier.","plain_action":"","product_name":"viseek-easy-custom-search","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the viseek-easy-custom-search WordPress plugin at version 1.0.5 or earlier are exposed. The attack needs a logged-in administrator to visit a malicious page, so sites without this plugin can skip it.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000753,"input_tokens":4550,"output_tokens":595,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121770':14A,17A '-2026':13A,16A '1.0.5':50B,100C 'action':11A 'admin':10A 'affect':95C 'allow':89C 'attack':7A,52B 'browser':61B 'chang':71B 'cross':42B,75C,90C 'cross-sit':41B,74C 'csrf':4A,79C 'custom':21A,27B,33B,87C 'cve':12A,15A 'easi':26B,32B,86C 'easy':20A 'flaw':5A,46B 'forgeri':45B,78C 'forgery.this':93C 'intend':68B 'issu':94C 'let':6A 'log':57B 'logged-in':56B 'make':54B 'n/a':98C 'packag':23B 'plugin':3A,36B,72B 'request':44B,63B,77C,92C 'search':22A,28B,34B,88C 'send':62B 'set':73B 'site':43B,76C,91C 'trigger':8A 'unwant':9A 'user':59B,65B 'version':48B 'villathem':38B,82C 'viseek':1A,19A,25B,31B,83C,85C,96C 'viseek-easy-custom-search':18A,24B,84C 'vulner':80C 'wordpress':2A,29B,35B","nicknames":[],"mitigations":[],"who_affected":"Sites running the viseek-easy-custom-search WordPress plugin at version 1.0.5 or earlier are exposed. The attack needs a logged-in administrator to visit a malicious page, so sites without this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["viseekeasycustomsearch"],"ptokens":["custom","easy","search","viseek"],"labels":["medium","package","vendor","viseekeasycustomsearch","wordpress"],"campaign_type":null,"search_a":"'-121770':14A,17A '-2026':13A,16A 'action':11A 'admin':10A 'attack':7A 'csrf':4A 'custom':21A 'cve':12A,15A 'easy':20A 'flaw':5A 'let':6A 'plugin':3A 'search':22A 'trigger':8A 'unwant':9A 'viseek':1A,19A 'viseek-easy-custom-search':18A 'wordpress':2A","search_b":"'1.0.5':50B 'attack':52B 'browser':61B 'chang':71B 'cross':42B 'cross-sit':41B 'custom':27B,33B 'easi':26B,32B 'flaw':46B 'forgeri':45B 'intend':68B 'log':57B 'logged-in':56B 'make':54B 'packag':23B 'plugin':36B,72B 'request':44B,63B 'search':28B,34B 'send':62B 'set':73B 'site':43B 'user':59B,65B 'version':48B 'villathem':38B 'viseek':25B,31B 'viseek-easy-custom-search':24B 'wordpress':29B,35B","search_c":"'1.0.5':100C 'affect':95C 'allow':89C 'cross':75C,90C 'cross-sit':74C 'csrf':79C 'custom':87C 'easi':86C 'forgeri':78C 'forgery.this':93C 'issu':94C 'n/a':98C 'request':77C,92C 'search':88C 'site':76C,91C 'villathem':82C 'viseek':83C,85C,96C 'viseek-easy-custom-search':84C 'vulner':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T12:19:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121770","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121770","severity":null,"published_at":"2026-11-11T12:19:35+00:00","modified_at":"2026-11-11T12:19:35+00:00","first_seen_at":"2026-11-11T12:27:10+00:00","fetched_at":"2026-11-11T12:27:10+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}