CVE-2024-54393 HIGH

CVE-2024-54393: WordPress WP Fiddle plugin <= 1.0 - CSRF to Stored XSS vulnerability

Vendor Sheikh Heera
Product WP Fiddle
Weakness CWE-352 · CSRF
Published December 16, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability in Sheikh Heera WP Fiddle wp-fiddle allows Stored XSS.This issue affects WP Fiddle: from n/a through <= 1.0.

Explanation of Vulnerability in Simple Terms

02Summary

WP Fiddle versions 1.0 and earlier contain a cross-site request forgery (CSRF) vulnerability that allows an attacker to perform unauthorized actions on behalf of a logged-in site administrator. The vulnerability requires the victim to visit a malicious webpage while authenticated to the WordPress site. An attacker can modify site settings, create or delete content, or change user permissions depending on the actions available through the vulnerable component.

What an attacker can do

03Attacker Capabilities

Perform unauthorized actions on the site (modify settings, create/delete content, change permissions) on behalf of a logged-in admin.

Potential impact on your site

04Site Impact

An attacker can trick your admin into performing unwanted actions without their knowledge, potentially compromising site integrity and security.

Conditions required to exploit

05Prerequisites

Victim must be logged into WordPress and visit an attacker-controlled webpage while authenticated.

Key dates

06Disclosure timeline

December 16, 2024 CVE published
April 28, 2026 Record updated