WordPress WP-chgFontSize plugin cross-site request forgery vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress WP-chgFontSize plugin version 1.8 and earlier versions are vulnerable to cross-site request...

CVE-2022-1764

The CVE-2022-1764 entry concerns the WP-chgFontSize WordPress plugin (versions ≤ 1.8). The connected documents confirm the underlying issue: lack of CSRF protection when updating settings, allowing a logged-in admin to be targeted via CSRF to change settings and trigger a Stored XSS due to insuff...

WP-chgFontSize <= 1.8 - Arbitrary Settings Update via CSRF to Stored XSS

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping PoC...