WP Sticky Button < 1.4.1 - Unauthenticated Arbitrary Settings Update to Stored XSS
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 0.4%
probabilidade de exploração
0.4%top 73% das CVEs
exploração observada
nãonenhuma fonte reporta
The WP Sticky Button WordPress plugin before 1.4.1 does not have authorisation and CSRF checks when saving its settings, allowing unauthenticated users to update them. Furthermore, due to the lack of escaping in some of them, it could lead to Stored Cross-Site Scripting issues
Produtos afetados
Unknown · WP Sticky Button – Click to Chat