Lucene search
AshishWPVDB-ID:B47EA36E-F37C-4745-B750-31F5B91F543FHistoryJul 19, 2021 - 12:00 a.m.
Telugu Bible Verse Daily <= 1.0 - CSRF to Stored XSS
2021-07-1900:00:00
Ashish
wpscan.com
6
0.001 Low
EPSS
Percentile
28.1%
The plugin is lacking any CSRF check when saving its settings and verses, and do not sanitise or escape them when outputting them back in the page. This could allow attackers to make a logged in admin change the settings, as well as add malicious verses containing JavaScript code in them, leading to Stored XSS issues
PoC
| CPE | Name | Operator | Version |
|---|---|---|---|
| telugu-bible-verse-daily | eq | * |
Related
nvd
nvd
CVE-2021-24410
2021-08-16 11:15:08
cve
cve
CVE-2021-24410
2021-08-16 11:15:08
prion
prion
Cross site request forgery (csrf)
2021-08-16 11:15:00
cvelist
cvelist
CVE-2021-24410 Telugu Bible Verse Daily <= 1.0 - CSRF to Stored XSS
2021-08-16 10:48:19
wpexploit
wpexploit
Telugu Bible Verse Daily <= 1.0 - CSRF to Stored XSS
2021-07-19 00:00:00