Multiple vulnerabilities in "Custom Body Class"

Overview WordPress Plugin "Custom Body Class" provided by Andrei Lupu contains multiple vulnerabilities listed below. Cross-site Scripting CWE-79 - CVE-2019-6029 Cross-site Request Forgery CWE-352 - CVE-2019-6030 Shirai Masatake of Cryptography Laboratory,Department of Information and Communicati...

JVN#26847507: Multiple vulnerabilities in "Custom Body Class"

WordPress Plugin "Custom Body Class" provided by Andrei Lupu contains multiple vulnerabilities listed below. Cross-site Scripting CWE-79 - CVE-2019-6029 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N| Base Score: 6.1 CVSS v2| AV:N/AC:H/Au:N/C:N/I:P/A:N|...

WordPress Custom Body Class Cross-Site Request Forgery Vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports PHP and MySQL servers to set up a personal blog site . Custom Body Class is used in which a CSS class component plug-ins . WordPress Custom Body Class 0.6.0 and previous versio...

WordPress Custom Body Class Cross-Site Scripting Vulnerability

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports PHP and MySQL servers to set up a personal blog site . Custom Body Class is used in which a CSS class component plug-ins . WordPress Custom Body Class 0.6.0 and previous versio...

WordPress WP Custom Body Class plugin <= 0.7.0 - Cross-Site Request Forgery (CSRF) > Stored Cross-Site Scripting (XSS) + Settings Update vulnerabilities

Cross-Site Request Forgery CSRF Stored Cross-Site Scripting XSS + Settings Update vulnerabilities found in WordPress WP Custom Body Class plugin versions = 0.7.0. Solution Update the WordPress WP Custom Body Class plugin to the latest available version at least 0.7.1...

WP Custom Body Class <= 0.7.0 - CSRF to Stored XSS and Settings Update

Lack of CSRF check and sanitisation when updating the plugin's settings could lead to unauthorised settings update as well as stored XSS issues XSS fixed in 0.7.0. CSRF still there - vendor contacted CSRF fixed in 0.7.1 /wp-admin/options-general.php?page=custombodyclass" method="POST" ' /...