Lucene search
Bob MatyasWPVDB-ID:B54B55E0-B184-4C90-BA94-FEDA0997BF2AHistoryJun 04, 2024 - 12:00 a.m.
Logo Manager For Enamad <= 0.7.0 - Stored XSS via CSRF
2024-06-0400:00:00
Bob Matyas
wpscan.com
5
enamad logo manager
stored xss
csrf
security vulnerability
sanitisation
Description The plugin does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
PoC
Make a logged in admin open an HTML file containing:
Related
wpexploit
wpexploit
Logo Manager For Enamad <= 0.7.0 - Stored XSS via CSRF
2024-06-04 00:00:00
nvd
nvd
CVE-2024-4757
2024-06-25 06:15:11
cvelist
cvelist
CVE-2024-4757 Logo Manager For Enamad <= 0.7.0 - Stored XSS via CSRF
2024-06-25 06:00:02
cve
cve
CVE-2024-4757
2024-06-25 06:15:11
vulnrichment
vulnrichment
CVE-2024-4757 Logo Manager For Enamad <= 0.7.0 - Stored XSS via CSRF
2024-06-25 06:00:02
wordfence
wordfence
AI Score
5.5
Confidence
High
EPSS
0
Percentile
9.1%
Related for WPVDB-ID:B54B55E0-B184-4C90-BA94-FEDA0997BF2A