CVE-2024-32958 HIGH

CVE-2024-32958: WordPress Slash Admin plugin <= 3.8.1 - CSRF to XSS vulnerability

Vendor Giorgos Sarigiannidis
Product Slash Admin
Weakness CWE-352 · CSRF
Published April 24, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability in Giorgos Sarigiannidis Slash Admin allows Cross-Site Scripting (XSS).This issue affects Slash Admin: from n/a through 3.8.1.

Explanation of Vulnerability in Simple Terms

02Summary

Slash Admin versions up to 3.8.1 contain a cross-site request forgery (CSRF) vulnerability that allows an attacker to perform unauthorized actions on behalf of an authenticated user. The vulnerability requires user interaction—typically clicking a malicious link or visiting a compromised page. An attacker can read, modify, or delete data depending on the user's permissions. Update to a version newer than 3.8.1.

What an attacker can do

03Attacker Capabilities

Perform unauthorized actions (read, modify, or delete data) on behalf of a logged-in user without their knowledge.

Potential impact on your site

04Site Impact

Users' accounts can be compromised to perform unintended actions; data integrity and confidentiality at risk depending on user role.

Conditions required to exploit

05Prerequisites

Victim must be logged into Slash Admin and click a malicious link or visit an attacker-controlled page.

Key dates

06Disclosure timeline

April 24, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-65464 WordPress GiveWP plugin <= 4.16.3 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-61956 WordPress ووسلام – همگام سازی ووکامرس و باسلام plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-59520 WordPress CrawlWP SEO plugin <= 3.0.16 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-63684 Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various admin/import/export actions of multiple Regular Labs extension CVE-2026-15070 Salon Booking System <= 10.30.32 - Cross-Site Request Forgery to Remote Code Execution via 'value' Parameter