CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in Victor Barkalov Custom Links On Admin Dashboard Toolbar customize-wpadmin allows Stored XSS.This issue affects Custom Links On Admin Dashboard Toolbar: from n/a through <= 3.3.
Explanation of Vulnerability in Simple Terms
Custom Links On Admin Dashboard Toolbar versions 3.3 and earlier are vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the site without the admin's knowledge or consent. The vulnerability affects the admin dashboard toolbar functionality and requires user interaction to exploit.
What an attacker can do
Perform unauthorized actions on the site by tricking a logged-in admin into visiting a malicious webpage.
Potential impact on your site
Admins could unknowingly authorize changes to site settings, content, or configuration via CSRF attacks targeting the toolbar.
Conditions required to exploit
Admin must be logged in and visit an attacker-controlled webpage; no special privileges or authentication required from attacker.
Key dates
External resources
Related vulnerabilities
