Sitetweet <= 0.2 - Stored XSS via CSRF

2024-06-1100:00:00

wpscan.com

sitetweet plugin

vulnerability

stored xss

csrf

june 25 2024

update

software

5.6 Medium

AI Score

Confidence

High

0 Low

EPSS

Percentile

0.0%

JSON

Description The plugin does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack

PoC

The PoC will be displayed on June 25, 2024, to give users the time to update.