CVE-2023-0420
Assigner: WPScan
Published: 2023-04-24T18:30:49.071Z
State: PUBLISHED
title: Custom Post Type and Taxonomy GUI Manager <= 1.1 - Stored XSS via CSRF
problemTypes: descriptions: description: CWE-79 Cross-Site Scripting (XSS)
type: CWE
descriptions: description: CWE-352 Cross-Site Request Forgery (CSRF)
type: CWE
affected: vendor: Unknown
product: Custom Post Type and Taxonomy GUI Manager
versions: status: affected
versionType: custom
version: 0
lessThanOrEqual: 1.1
defaultStatus: affected
collectionURL: https://wordpress.org/plugins
descriptions: value: The Custom Post Type and Taxonomy GUI Manager WordPress plugin through 1.1 does not have CSRF, and is lacking sanitising as well as escaping in some parameters, allowing attackers to make a logged in admin put Stored Cross-Site Scripting payloads via CSRF
credits: value: Shreya Pohekar
type: finder
value: WPScan
type: coordinator
source: discovery: EXTERNAL
x_generator: engine: WPScan CVE Generator