Lucene search
Daniel RufWPVDB-ID:BA77704A-32A1-494B-B2C0-E1C2A3F98ADCHistoryJan 10, 2024 - 12:00 a.m.
Voting Record <= 2.0 - Settings Update to Stored XSS via CSRF
2024-01-1000:00:00
Daniel Ruf
wpscan.com
3
plugin
csrf
stored xss
sanitisation
escaping
Description The plugin does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
PoC
Have an admin open an HTML page containing the following: You will see the pop-up showing the XSS.
Related
nvd
nvd
CVE-2023-7083
2024-01-16 16:15:13
wpexploit
wpexploit
Voting Record <= 2.0 - Settings Update to Stored XSS via CSRF
2024-01-10 00:00:00
prion
prion
Cross site request forgery (csrf)
2024-01-16 16:15:00
cve
cve
CVE-2023-7083
2024-01-16 16:15:13
cvelist
cvelist
CVE-2023-7083 Voting Record <= 2.0 - Settings Update to Stored XSS via CSRF
2024-01-16 15:57:04
wordfence
wordfence
5.5 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
14.2%
Related for WPVDB-ID:BA77704A-32A1-494B-B2C0-E1C2A3F98ADC