CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in shisuh Related Posts Line-up-Exactly by Milliard related-posts-line-up-exactry-by-milliard allows Stored XSS.This issue affects Related Posts Line-up-Exactly by Milliard: from n/a through <= 0.0.22.
Explanation of Vulnerability in Simple Terms
The Related Posts Line-up-Exactly plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability that allows attackers to perform unauthorized actions on behalf of site administrators. An attacker can craft a malicious webpage that, when visited by an admin, executes unwanted plugin operations without their knowledge. The vulnerability affects versions 0.0.22 and earlier. Site owners should update to a patched version when available.
What an attacker can do
Trick a site admin into visiting a malicious page that performs unauthorized plugin actions on their behalf.
Potential impact on your site
Attackers can modify plugin settings or trigger unintended actions if an admin visits a compromised site.
Conditions required to exploit
Admin must visit attacker-controlled webpage; no authentication bypass needed.
Key dates
External resources
Related vulnerabilities
