Webarea vulnerabilities and threats

The Fast & Fancy Filter – 3F WordPress plugin versions up to 1.2.2 contain a Cross-Site Request Forgery (CSRF) vulnerability due to missing nonce verification in the saveFields() function. This flaw allows unauthenticated attackers to modify plugin filter settings, update arbitrary options, or create new filter posts if they can trick a site administrator into performing an action such as clicking a malicious link. The vulnerability has a CVSS score of 4.3, indicating medium severity. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Webarea Background animation blocks background-animation-blocks allows PHP Local File Inclusion.This issue affects Background animation blocks: from n/a through <= 2.1.5.