Lucene search
Chloe ChamberlandWPVDB-ID:169D21FC-D191-46FF-82E8-9AC887AED8A4HistoryMar 25, 2021 - 12:00 a.m.
Facebook for WordPress 3.0.0-3.0.3 - CSRF to Stored XSS and Settings Deletion
2021-03-2500:00:00
Chloe Chamberland
wpscan.com
3
The wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_settings AJAX actions of the plugin were vulnerable to CSRF due to a lack of nonce protection. The settings in the saveFbeSettings function had no sanitization allowing for script tags to be saved.
PoC
CSRF to XSS CSRF to Delete settings
| CPE | Name | Operator | Version |
|---|---|---|---|
| official-facebook-pixel | lt | 3.0.4 |
Related
openvas
openvas
WordPress Facebook for WordPress Plugin 3.0.x < 3.0.4 CSRF Vulnerability
2021-04-13 00:00:00
wpexploit
wpexploit
prion
prion
Cross site request forgery (csrf)
2021-04-12 14:15:00
cvelist
cvelist
cve
cve
CVE-2021-24218
2021-04-12 14:15:00
Related for WPVDB-ID:169D21FC-D191-46FF-82E8-9AC887AED8A4