CVE-2023-6499

The lasTunes WordPress plugin through 3.6.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2023-6499 lasTunes <= 3.6.1 - Settings Update via CSRF

The lasTunes WordPress plugin through 3.6.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

WordPress Plugin lasTunes Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

PT-2024-14977 · WordPress · Lastunes

Name of the Vulnerable Software and Affected Versions: lasTunes WordPress plugin versions 3.6.1 and earlier Description: The issue is related to the lack of CSRF checks in some places, as well as missing sanitization and escaping, which could allow attackers to make logged-in admins add Stored XS...

WordPress lasTunes Plugin <= 3.6.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software lasTunes Type Plugin Vulnerable versions = 3.6.1 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-6499 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 87d3b56ef4f1 Credits Daniel Ruf Required privilege...

lasTunes <= 3.6.1 - Settings Update via CSRF

Description The plugin does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack PoC...