Multi-page Toolkit <= 2.6 - Arbitrary Settings Update to Stored XSS via CSRF
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 0.3%
probabilidade de exploração
0.3%top 79% das CVEs
exploração observada
nãonenhuma fonte reporta
The Multi-page Toolkit WordPress plugin through 2.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping as well
Produtos afetados
Unknown · Multi-page Toolkit