CVE-2022-1618

The Coru LFMember WordPress plugin through 1.0.2 does not have CSRF check in place when adding a new game, and is lacking sanitisation as well as escaping in their settings, allowing attacker to make a logged in admin add an arbitrary game with XSS payloads...

PT-2024-11512 · WordPress · Coru Lfmember Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: The Coru LFMember WordPress plugin versions 1.0.2 and earlier Description: The issue is related to the lack of CSRF check when adding a new game and insufficient sanitization and escaping in the settings. This allows an attacker to make a...