CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in Icegram Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building.This issue affects Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building: from n/a through 3.1.18.
Explanation of Vulnerability in Simple Terms
Icegram Engage versions up to 3.1.18 contain a cross-site request forgery (CSRF) vulnerability. An attacker can craft a malicious webpage that, when visited by a logged-in WordPress admin, performs unwanted actions within the plugin without the admin's knowledge or consent. The vulnerability requires the admin to visit the attacker's page but does not require the attacker to have any account or special privileges.
What an attacker can do
Perform unwanted actions in the plugin on behalf of a logged-in WordPress admin.
Potential impact on your site
An attacker could modify plugin settings, create unwanted popups, or alter email list configurations via a CSRF attack.
Conditions required to exploit
Admin must visit a malicious webpage while logged into WordPress.
Key dates
External resources
Related vulnerabilities
