Shopping Pages Vulnerabilities

[en] The WP Shopping Pages WordPress plugin through 1.14 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.

Affected:

up to 1.14

Fix:

No patched version reported

Disclosed:

Aug 7, 2023

CVE-2023-3492 on NVD →

The WP Shopping Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.14. This is due to missing or incorrect nonce validation on an unknown function. This makes it possible for unauthenticated attackers to add malicious JavaScript payloads to the site via a forged r...

CVSS:

7.1

Affected:

up to 1.14

Fix:

No patched version reported

Disclosed:

Jul 17, 2023

CVE-2023-3492 on NVD →