Lucene search
WpvulndbWPVDB-ID:0B34445A-D91D-47C0-8301-13D442FE58CBHistorySep 21, 2022 - 12:00 a.m.
Demon Image Annotation < 4.8 - Arbitrary Settings Update to Stored XSS via CSRF
2022-09-2100:00:00
wpscan.com
4
demon image annotation
csrf protection
settings update
stored xss
software
0.002 Low
EPSS
Percentile
60.8%
The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. Furthermore, due to the lack of sanitisation and escaping in some of them, it could also lead to Stored Cross-Site Scripting
| CPE | Name | Operator | Version |
|---|---|---|---|
| demon-image-annotation | lt | 4.8 |
Related
patchstack
patchstack
nvd
nvd
CVE-2022-2864
2022-10-28 17:15:22
cvelist
cvelist
CVE-2022-2864
2022-10-28 16:52:09
prion
prion
Cross site request forgery (csrf)
2022-10-28 17:15:00
cve
cve
CVE-2022-2864
2022-10-28 17:15:22
cnvd
cnvd
WordPress demon image annotation cross-site request forgery vulnerability
2022-10-31 00:00:00