WP-Walla <= 0.5.3.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
mediumThe WP-Walla plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and including, 0.5.3.5. This is due to missing nonce verification on the settings page and insufficient input sanitization and output escaping. This makes it possible for unauthenticated a...
- CVSS:
- 6.1
- Affected:
- up to 0.5.3.5
- Fix:
- No patched version reported
- Disclosed:
- Nov 10, 2025