CVE-2021-24615
Assigner: WPScan
Published: 2021-10-18T13:45:47
State: PUBLISHED
affected: product: 微信打赏（Wechat Reward)
vendor: Unknown
versions: lessThanOrEqual: 1.7
status: affected
version: 1.7
versionType: custom
credits: value: 听雨眠
descriptions: value: The Wechat Reward WordPress plugin through 1.7 does not sanitise or escape its QR settings, nor has any CSRF check in place, allowing attackers to make a logged in admin change the settings and perform Cross-Site Scripting attacks.
problemTypes: descriptions: cweId: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
type: CWE
descriptions: cweId: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
type: CWE
source: discovery: EXTERNAL
title: Wechat Reward <= 1.7 - CSRF to Stored Cross-Site Scripting
x_generator: WPScan CVE Generator