Lucene search
WPScanCVELIST:CVE-2024-7860HistorySep 12, 2024 - 6:00 a.m.
CVE-2024-7860 Simple Headline Rotator <= 1.0 - Stored XSS via CSRF
2024-09-1206:00:06
WPScan
www.cve.org
6
cve-2024-7860
stored xss
csrf
wordpress plugin
EPSS
0.001
Percentile
17.7%
The Simple Headline Rotator WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
CNA Affected
[
{
"vendor": "Unknown",
"product": "Simple Headline Rotator",
"versions": [
{
"status": "affected",
"versionType": "semver",
"version": "0",
"lessThanOrEqual": "1.0"
}
],
"defaultStatus": "affected"
}
]Related
nvd
nvd
CVE-2024-7860
2024-09-12 06:15:24
vulnrichment
vulnrichment
CVE-2024-7860 Simple Headline Rotator <= 1.0 - Stored XSS via CSRF
2024-09-12 06:00:06
cve
cve
CVE-2024-7860
2024-09-12 06:15:24
wordfence
wordfence