Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
wpvulndbBob MatyasWPVDB-ID:55DFB9B5-D590-478B-BD1F-D420B79037FA
HistoryMay 24, 2024 - 12:00 a.m.

Similarity <= 3.0 - Stored XSS via CSRF

2024-05-2400:00:00
Bob Matyas
wpscan.com
1
plugin
csrf
sanitization
stored xss
attackers
admin

5.5 Medium

AI Score

Confidence

High

JSON

Description The plugin does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack

PoC

Make a logged in admin open an HTML file containing:

Related

nvd 1
wpexploit 1
cve 1
cvelist 1
wordfence 1
nvd
nvd
CVE-2024-3972
2024-06-14 06:15:12
wpexploit
wpexploit
Similarity <= 3.0 - Stored XSS via CSRF
2024-05-24 00:00:00
cve
cve
CVE-2024-3972
2024-06-14 06:15:12
cvelist
cvelist
CVE-2024-3972 Similarity <= 3.0 - Stored XSS via CSRF
2024-06-14 06:00:03
wordfence
wordfence
Wordfence Intelligence Weekly WordPress Vulnerability Report (May 20, 2024 to May 26, 2024)
2024-05-30 15:23:45

5.5 Medium

AI Score

Confidence

High

JSON
Related for WPVDB-ID:55DFB9B5-D590-478B-BD1F-D420B79037FA
nvd1wpexploit1cve1cvelist1wordfence1