Lucene search

K
wpvulndbRezadutyWPVDB-ID:0FF435BC-EA20-4993-98AE-1F61B1732B59
HistoryDec 28, 2022 - 12:00 a.m.

Optimize images ALT Text (alt tag) & names for SEO using AI < 2.0.8 - Settings Update via CSRF

2022-12-2800:00:00
rezaduty
wpscan.com
5
images
alt text
seo
ai
plugin
csrf
vulnerability
settings
attack
admin
software

EPSS

0.001

Percentile

27.0%

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack.

PoC

Use the following form to abuse the CSRF vulnerability on the settings page: action|
—|—
layout|
textColor|
contentBackgroundColor|
starColor|
visibilitySubTitle|
visibilitySubTitleTwo|
visibilityAvatar|
visibilityRating|
defaultBgImg|
textAlignment|
logoUrl|

EPSS

0.001

Percentile

27.0%

Related for WPVDB-ID:0FF435BC-EA20-4993-98AE-1F61B1732B59