ImageMapper <= 1.2.6 - Stored XSS via CSRF

2023-11-1600:00:00

wpscan.com

stored xss

csrf

csrf attack

arbitrary post titles

imgmap_save_area_title

logged in admins

security vulnerability

8.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

20.8%

JSON

Description The plugin does not have CSRF check in its imgmap_save_area_title function, which could allow attackers to make logged in admins update arbitrary post titles with XSS payloads via a CSRF attack