Extra User Details Vulnerabilities

The Extra User Details plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbi...

CVSS:

4.4

Affected:

up to 0.5

Fixed in:

0.5.1

Disclosed:

Jun 19, 2023

CVE-2023-35878 on NVD →

The Extra User Details plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.5. This is due to missing or incorrect nonce validation on the eud_plugin_options() function. This makes it possible for unauthenticated attackers to modify the plugins settings via a forged reque...

CVSS:

4.3

Affected:

up to 0.5

Fixed in:

0.5.1

Disclosed:

Jun 19, 2023

CVE-2023-35877 on NVD →