Lucene search
HistoryApr 15, 2024 - 5:15 a.m.
CVE-2024-2857
cve-2024-2857
organization
individual
announcing
security
problem
publicized
details
nvd
The Simple Buttons Creator WordPress plugin through 1.04 does not have any authorisation as well as CSRF in its add button function, allowing unauthenticated users to call them either directly or via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping, it could also allow them to perform Stored Cross-Site Scripting attacks against logged in admins.
| Vendor | Product | Version | CPE |
|---|---|---|---|
| wpbrigade | simple_social_buttons | * | cpe:2.3:a:wpbrigade:simple_social_buttons:*:*:*:*:*:*:*:* |
Related
wpexploit
wpexploit
Simple Buttons Creator <= 1.04 - Unauthenticated Stored XSS
2024-03-25 00:00:00
wpvulndb
wpvulndb
Simple Buttons Creator <= 1.04 - Unauthenticated Stored XSS
2024-03-25 00:00:00
cvelist
cvelist
CVE-2024-2857 Simple Buttons Creator <= 1.04 - Unauthenticated Stored XSS
2024-04-15 05:00:05
wordfence
wordfence