Simple Bitcoin Faucets by Alexey Trofimov <= 1.7.0 - Unauthorised AJAX request to Stored XSS
LANACOMMONVDB ID: 6094f9ae-722b-4a1a-8c5d-2da16d22700f
The plugin does not have any authorisation and Cross-Site Request Forgery (CSRF) check in an AJAX action, allowing any authenticated users, such as subscribers to call it and add/delete/edit Bonds. Furthermore, due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting (XSS) issues.
Attributes
- Catgory
- WordPress Plugin
- Discovered
- 2022-08-27
- Published
- 2022-08-31
- Affected Version
- <= 1.7.0
Classification
- Type
- Cross-Site Request Forgery (CSRF), Cross-Site Scripting (XSS), Missing Authorization
Support Us?
We would truly appreciate it if you bought us a bunny (food for a snow leopard).
