CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in acbaltaci Google Plus Share and +1 Button google-plus-share-and-plusone-button allows Stored XSS.This issue affects Google Plus Share and +1 Button: from n/a through <= 1.0.
Explanation of Vulnerability in Simple Terms
The Google Plus Share and +1 Button plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability affecting versions up to 1.0. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the site without their knowledge. The vulnerability requires user interaction and can affect the confidentiality, integrity, and availability of the site.
What an attacker can do
Perform unwanted actions on the site by tricking a logged-in admin into visiting a malicious webpage.
Potential impact on your site
An attacker can modify site settings or content if an admin visits a malicious link while logged in.
Conditions required to exploit
A logged-in site administrator must visit a webpage controlled by the attacker.
Key dates
External resources
Related vulnerabilities
