Lucene search
Daniel RufWPVDB-ID:7F2AE2C9-57D4-46A0-A9A1-585EC543B153HistoryMay 23, 2022 - 12:00 a.m.
postTabs <= 2.10.6 - Arbitrary Settings Update via CSRF to Stored XSS
2022-05-2300:00:00
Daniel Ruf
wpscan.com
6
0.001 Low
EPSS
Percentile
21.2%
The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, which also lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
PoC
Related
wpexploit
wpexploit
postTabs <= 2.10.6 - Arbitrary Settings Update via CSRF to Stored XSS
2022-05-23 00:00:00
cnvd
cnvd
WordPress postTabs plugin cross-site request forgery vulnerability
2022-06-15 00:00:00
prion
prion
Cross site scripting
2022-06-13 13:15:00
cvelist
cvelist
cve
cve
CVE-2022-1781
2022-06-13 13:15:12
nvd
nvd
CVE-2022-1781
2022-06-13 13:15:12
patchstack
patchstack