CVE-2024-3903

2024-05-1415:42:33

[email protected]

web.nvd.nist.gov

cve-2024-3903

wordpress

csrf

xss

vulnerability

nvd

5.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

The Add Custom CSS and JS WordPress plugin through 1.20 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in as author and above add Stored XSS payloads via a CSRF attack

Affected configurations

Vulners

Node

silkypresssimple_custom_css_and_jsRange≤1.20

VendorProductVersionCPE
silkypresssimple_custom_css_and_js*cpe:2.3:a:silkypress:simple_custom_css_and_js:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
silkypress	simple_custom_css_and_js	*	cpe:2.3:a:silkypress:simple_custom_css_and_js::::::::

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Add Custom CSS and JS",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThanOrEqual": "1.20"
      }
    ],
    "defaultStatus": "affected"
  }
]