CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in LionScripts.com LionScripts: Site Maintenance & Noindex Nofollow Plugin maintenance-and-noindex-nofollow allows Stored XSS.This issue affects LionScripts: Site Maintenance & Noindex Nofollow Plugin: from n/a through <= 2.1.
Explanation of Vulnerability in Simple Terms
The LionScripts Site Maintenance & Noindex Nofollow plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability in versions 2.1 and earlier. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unauthorized actions on the site without the admin's knowledge or consent. This could allow changes to plugin settings or site configuration.
What an attacker can do
Perform unauthorized actions on the site by tricking an admin into visiting a malicious webpage.
Potential impact on your site
Plugin settings or site configuration could be altered without your knowledge if you visit a malicious link.
Conditions required to exploit
Admin must visit attacker-controlled webpage while logged into WordPress.
Key dates
External resources
Related vulnerabilities
