CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in Venugopal Change default login logo,url and title allows Cross-Site Scripting (XSS).This issue affects Change default login logo,url and title: from n/a through 2.0.
Explanation of Vulnerability in Simple Terms
A cross-site request forgery (CSRF) vulnerability in the Change default login logo, url and title plugin allows an attacker to perform unauthorized actions on behalf of an authenticated site administrator. The attacker must trick an admin into visiting a malicious webpage while logged in. This can result in unauthorized changes to site login settings, including the logo, URL, and title.
What an attacker can do
Trick a logged-in admin into changing the site's login logo, URL, and title without their knowledge.
Potential impact on your site
An attacker can modify your login page appearance and redirect settings if an admin visits a malicious link while logged in.
Conditions required to exploit
Admin must be logged in and visit an attacker-controlled webpage; no special privileges required from attacker.
Key dates
External resources
Related vulnerabilities
