Lucene search
PRIOn knowledge basePRION:CVE-2022-3024HistorySep 26, 2022 - 1:15 p.m.
Cross site scripting
2022-09-2613:15:00
PRIOn knowledge base
www.prio-n.com
7
wordpress plugin
authorization
csrf
ajax action
authenticated users
bonds
stored cross-site scripting
0.001 Low
EPSS
Percentile
21.4%
The Simple Bitcoin Faucets WordPress plugin through 1.7.0 does not have any authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscribers to call it and add/delete/edit Bonds. Furthermore, due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues
| CPE | Name | Operator | Version |
|---|---|---|---|
| simple_bitcoin_faucets | le | 1.7.0 |
Related
patchstack
patchstack
wpvulndb
wpvulndb
Simple Bitcoin Faucets <= 1.7.0 - Unauthorised AJAX Call to Stored XSS
2022-08-31 00:00:00
nvd
nvd
CVE-2022-3024
2022-09-26 13:15:10
cvelist
cvelist
cnvd
cnvd
WordPress Simple Bitcoin Faucets Cross-Site Request Forgery Vulnerability
2022-09-28 00:00:00
cve
cve
CVE-2022-3024
2022-09-26 13:15:10
wpexploit
wpexploit
Simple Bitcoin Faucets <= 1.7.0 - Unauthorised AJAX Call to Stored XSS
2022-08-31 00:00:00