CVE-2016-20074

WordPress Lazy Content Slider Plugin 3.4 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by crafting malicious HTML forms. Attackers can trick authenticated administrators into submitting POST requests to the plugin settings page via lzcs_admin.php to modify plugin configuration parameters like lzcs_color and lzcs_count.

CVSS v4.0

5.3 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS

0.10% chance of exploitation in the next 30 days, 1th percentile

Published

2026-06-15

Updated

2026-07-28

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/40070

References

• CVE Record
• NVD entry

Related

• CVE-2016-20073
• CVE-2016-20075
• CVE-2016-20072
• CVE-2016-20076
• CVE-2016-20071
• CVE-2016-20077