CVE-2024-3823

The Base64 Encoder/Decoder WordPress plugin (versions 0.9.2 and earlier ) is vulnerable to Stored XSS via CSRF . The root cause is a lack of CSRF checks when updating plugin settings, combined with missing sanitization and escaping . An attacker could leverage these flaws to force a logged-in adm...

Cross site request forgery (csrf)

The FTP Access WordPress plugin through 1.0 does not have authorisation and CSRF checks when updating its settings and is missing sanitisation as well as escaping in them, allowing any authenticated users, such as subscriber to update them with XSS payloads, which will be triggered when an admin...