WordPress St-Daily-Tip plugin cross-site request forgery vulnerability

WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. WordPress St-Daily-Tip plugin has a cross-site request spoofing vulnerability in version 4.7 and earlier, which stems from a...

CVE-2021-24487

The St-Daily-Tip WordPress plugin through 4.7 does not have any CSRF check in place when saving its 'Default Text to Display if no tips' setting, and was also lacking sanitisation as well as escaping before outputting it the page. This could allow attacker to make logged in administrators set a...

CVE-2021-24487

The St-Daily-Tip WordPress plugin through 4.7 does not have any CSRF check in place when saving its 'Default Text to Display if no tips' setting, and was also lacking sanitisation as well as escaping before outputting it the page. This could allow attacker to make logged in administrators set a...

CVE-2021-24487

CVE-2021-24487 concerns the WordPress plugin St-Daily-Tip (versions ≤ 4.7). The vulnerability arises from a lack of CSRF protection and insufficient sanitisation/escaping when saving the setting “Default Text to Display if no tips,” allowing a logged-in attacker to cause a stored Cross-Site Scrip...

WordPress plugin St-Daily-Tip 跨站脚本漏洞

WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. WordPress St-Daily-Tip plugin has a cross-site request spoofing vulnerability in version 4.7 and earlier, which stems from a...

WordPress St-Daily-Tip plugin <= 4.7 - Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS)

Cross-Site Request Forgery CSRF vulnerability leading to Stored Cross-Site Scripting XSS discovered by Akash Rajendra Patil in WordPress St-Daily-Tip plugin versions = 4.7. Solution Deactivate and delete. This plugin has been closed as of June 28, 2021 and is not available for download. Reason:...