CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in marcucci Password Protect Plugin for WordPress password-protect-plugin-for-wordpress allows Stored XSS.This issue affects Password Protect Plugin for WordPress: from n/a through <= 0.8.1.0.
Explanation of Vulnerability in Simple Terms
The Password Protect Plugin for WordPress versions 0.8.1.0 and earlier contains a cross-site request forgery (CSRF) vulnerability. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unauthorized actions on the site without the admin's knowledge or consent. The vulnerability affects the plugin's core functionality and can lead to unauthorized changes to site settings or content.
What an attacker can do
Trick a site admin into visiting a malicious page that performs unauthorized actions on the site.
Potential impact on your site
Admins visiting untrusted links while logged in may unknowingly authorize changes to site settings or plugin configuration.
Conditions required to exploit
Admin must be logged in and visit an attacker-controlled webpage; no special plugin configuration required.
Key dates
External resources
Related vulnerabilities
