CVE-2026-1393: CSRF in Add Google Social Profiles to Knowledge Graph Box

An attacker can exploit this CSRF vulnerability to modify the plugin's Knowledge Graph settings without authentication. This could involve altering the displayed social profiles, potentially leading to misinformation or phishing attacks targeting site visitors. Successful exploitation requires the attacker to convince a site administrator to click a malicious link containing the forged request. While the direct impact is limited to the plugin's settings, a compromised Knowledge Graph box could damage a website's credibility and user trust. This vulnerability highlights the importance of proper nonce validation in WordPress plugins to prevent unauthorized modifications.

1. Reserved2026-01-23
2. Published2026-03-21
3. Modified2026-04-08
4. EPSS updated2026-03-28

The primary mitigation for CVE-2026-1393 is to upgrade to a patched version of the Add Google Social Profiles to Knowledge Graph Box plugin once available. Until a patch is released, consider implementing a Web Application Firewall (WAF) with CSRF protection rules to filter out malicious requests. Additionally, enforce strong password policies and multi-factor authentication for all administrator accounts to reduce the risk of successful exploitation. Regularly review plugin settings for any unauthorized changes.

Active installs

20

Plugin rating