CVE-2024-31105 HIGH

CVE-2024-31105: WordPress Tax Rate Upload plugin <= 2.4.5 - CSRF leading to Cross Site Scripting (XSS) vulnerability

Vendor Adam Bowen
Product Tax Rate Upload
Weakness CWE-352 · CSRF
Published April 2, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability in Adam Bowen Tax Rate Upload allows Reflected XSS.This issue affects Tax Rate Upload: from n/a through 2.4.5.

Explanation of Vulnerability in Simple Terms

02Summary

Tax Rate Upload versions up to 2.4.5 contain a cross-site request forgery (CSRF) vulnerability that allows an attacker to perform unauthorized actions on behalf of a logged-in user. The vulnerability requires user interaction—the victim must visit a malicious page while authenticated. An attacker can modify tax rates or other settings without the user's knowledge.

What an attacker can do

03Attacker Capabilities

Perform unauthorized actions (modify tax rates, settings) on behalf of a logged-in user.

Potential impact on your site

04Site Impact

Tax rates and plugin settings can be altered by attackers without your consent or knowledge.

Conditions required to exploit

05Prerequisites

Victim must be logged in and visit an attacker-controlled page or link.

Key dates

06Disclosure timeline

April 2, 2024 CVE published
April 28, 2026 Record updated