CVE-2023-3492
Assigner: WPScan
Published: 2023-08-07T14:31:19.856Z
State: PUBLISHED
title: WP Shopping Pages <= 1.14 - Stored XSS via CSRF
problemTypes: descriptions: description: CWE-352 Cross-Site Request Forgery (CSRF)
type: CWE
descriptions: description: CWE-79 Cross-Site Scripting (XSS)
type: CWE
affected: vendor: Unknown
product: WP Shopping Pages
versions: status: affected
versionType: custom
version: 0
lessThanOrEqual: 1.14
defaultStatus: affected
collectionURL: https://wordpress.org/plugins
descriptions: value: The WP Shopping Pages WordPress plugin through 1.14 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
credits: value: Katharina Altmann
type: finder
value: WPScan
type: coordinator
source: discovery: EXTERNAL
x_generator: engine: WPScan CVE Generator