CVE-2024-30560 CRITICAL

CVE-2024-30560: WordPress DX-Watermark plugin <= 1.0.4 - CSRF to Arbitrary File Upload and XSS vulnerability

Vendor 大侠Wp
Product DX-Watermark
Weakness CWE-352 · CSRF
Published April 25, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

9.6/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability in 大侠WP DX-Watermark.This issue affects DX-Watermark: from n/a through 1.0.4.

Explanation of Vulnerability in Simple Terms

02Summary

DX-Watermark versions up to 1.0.4 contain a cross-site request forgery (CSRF) vulnerability that allows an attacker to trick a site administrator into performing unwanted actions. The vulnerability requires the admin to visit a malicious webpage while logged in. An attacker can modify site settings, create accounts, or alter content without the admin's knowledge or consent.

What an attacker can do

03Attacker Capabilities

Trick a logged-in admin into performing unwanted actions like changing settings or creating accounts via a malicious webpage.

Potential impact on your site

04Site Impact

An attacker can modify your site's watermark settings, create unauthorized admin accounts, or alter content if they trick you into visiting a malicious link.

Conditions required to exploit

05Prerequisites

Admin must be logged in and visit an attacker-controlled webpage; no special privileges or authentication by the attacker required.

Key dates

06Disclosure timeline

April 25, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2022-47150 WordPress WooCommerce Conversion Tracking plugin <= 2.0.10 - Cross-Site Request Forgery (CSRF) vulnerability CVE-2026-12002 Smash Balloon Social Photo Feed – Easy Social Feeds Plugin <= 6.11.1 - Cross-Site Request Forgery to oEmbed Access Token Overwrite via 'sbi_access_token' Parameter CVE-2026-63684 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various admin/import/export actions of multiple Regular Labs extension CVE-2026-63265 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various Regular Labs extension AJAX endpoints CVE-2016-20074 WordPress Lazy Content Slider Plugin 3.4 CSRF