Category Post List Widget Vulnerabilities

[en] Cross-Site Request Forgery (CSRF) vulnerability in Stark Digital Category Post List Widget allows Stored XSS.This issue affects Category Post List Widget: from n/a through 2.0.

Affected:

up to 2.0

Fix:

No patched version reported

Disclosed:

Nov 13, 2023

CVE-2023-47516 on NVD →

The Category Post List Widget plugin for WordPress is vulnerable to stored Cross-Site Scripting via the ‘custom_css’ parameter in versions up to, and including, 2.0 due to insufficient input sanitization and output escaping and a lack of a nonce check on the 'get_cplw_settings' function. This makes it possible for unau...

CVSS:

6.1

Affected:

up to 2.0

Fix:

No patched version reported

Disclosed:

Nov 7, 2023

CVE-2023-47516 on NVD →

The Category Post List Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0. This is due to missing or incorrect nonce validation on the get_cplw_settings function. This makes it possible for unauthenticated attackers to change the plugin's settings, includin...

CVSS:

6.1

Affected:

up to 2.0

Fix:

No patched version reported

Disclosed:

Nov 7, 2023

CVE-2023-47516 on NVD →