WPGlobus plugin Stored XSS & CSRF security vulnerability

2022-05-1403:49:04

Google

osv.dev

6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

26.2%

JSON

The WPGlobus plugin 1.9.6 for WordPress has XSS via the wpglobus_option[enabled_languages][en] or wpglobus_option[enabled_languages][fr] (or any other language) parameter to wp-admin/options.php.

CPENameOperatorVersion
wpglobus/wpglobuseq1.9.0
wpglobus/wpglobuseq1.6.9
wpglobus/wpglobuseq1.7.1
wpglobus/wpglobuseq1.9.1
wpglobus/wpglobuseq1.7.9
wpglobus/wpglobuseq1.8.4
wpglobus/wpglobuseq1.5.5
wpglobus/wpglobuseq1.2.7
wpglobus/wpglobuseq1.2.5
wpglobus/wpglobuseq1.7.7.1

Name	Operator	Version
wpglobus/wpglobus	eq	1.9.0
wpglobus/wpglobus	eq	1.6.9
wpglobus/wpglobus	eq	1.7.1
wpglobus/wpglobus	eq	1.9.1
wpglobus/wpglobus	eq	1.7.9
wpglobus/wpglobus	eq	1.8.4
wpglobus/wpglobus	eq	1.5.5
wpglobus/wpglobus	eq	1.2.7
wpglobus/wpglobus	eq	1.2.5
wpglobus/wpglobus	eq	1.7.7.1