CVE-2021-24922 Pixel Cat Lite < 2.6.2 - CSRF to Stored Cross-Site Scripting

2021-12-1310:41:19

CWE-352

WPScan

www.cve.org

pixel cat lite

wordpress plugin

csrf

stored xss

vulnerability

AI Score

8.6

Confidence

High

EPSS

0.001

Percentile

32.0%

JSON

The Pixel Cat WordPress plugin before 2.6.2 does not have CSRF check when saving its settings, and did not sanitise as well as escape some of them, which could allow attacker to make a logged in admin change them and perform Cross-Site Scripting attacks

CNA Affected

[
  {
    "product": "Pixel Cat – Conversion Pixel Manager",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "2.6.2",
        "status": "affected",
        "version": "2.6.2",
        "versionType": "custom"
      }
    ]
  }
]