CVE-2024-3993

The AZAN Plugin WordPress plugin through 0.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-3993 AZAN Plugin <= 0.6 - Stored XSS via CSRF

The AZAN Plugin WordPress plugin through 0.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-3993

The CVE-2024-3993 entry concerns the AZAN Plugin for WordPress (versions

CVE-2024-3993 AZAN Plugin <= 0.6 - Stored XSS via CSRF

The AZAN Plugin WordPress plugin through 0.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

WordPress plugin AZAN security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2024-28741 · WordPress · Azan Plugin

Name of the Vulnerable Software and Affected Versions: AZAN Plugin WordPress plugin versions 0.6 and earlier Description: The issue concerns the lack of CSRF checks in certain areas and missing sanitization and escaping, which could allow attackers to inject Stored XSS payloads via a CSRF attack,...

WordPress AZAN plugin <= 0.6 - CSRF Leading to Stored Cross-Site Scripting vulnerability

CSRF Leading to Stored Cross-Site Scripting vulnerability discovered by Bob Matyas in WordPress Plugin AZAN versions = 0.6...

AZAN Plugin <= 0.6 - Stored XSS via CSRF

Description The plugin does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack PoC Make a logged in admin open an HTML file containing: If the widget is loaded on a page...

AZAN Plugin <= 0.6 - Stored XSS via CSRF

Description The plugin does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack Make a logged in admin open an HTML file containing: alert999,2,2,3' / If the widget is...