CVE-2024-13096

creationtimestamp| type| source ---|---|--- 2025-02-01 06:15:56+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lh3uft57mu2f 2025-02-01 07:16:11+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/3719 2025-02-01 07:25:45+00:00| seen|...

CVE-2024-13096

The WP Finance WordPress plugin through 1.3.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-13096

The WP Finance WordPress plugin through 1.3.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-13096

The WP Finance WordPress plugin (versions 1.3.6 and earlier ) is vulnerable to Stored XSS via CSRF . The root cause is a lack of CSRF checks in certain areas, combined with missing sanitisation and escaping . This allows an attacker to trick a logged-in administrator into adding Stored XSS payloa...

CVE-2024-13096 WP Finance <= 1.3.6 - Stored XSS via CSRF

The WP Finance WordPress plugin through 1.3.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...