CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in frucomerci List of Posts from each Category plugin for WordPress list-posts-by-category allows Stored XSS.This issue affects List of Posts from each Category plugin for WordPress: from n/a through <= 2.0.
Explanation of Vulnerability in Simple Terms
The List of Posts from each Category plugin for WordPress versions 2.0 and earlier contains a cross-site request forgery (CSRF) vulnerability. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the site without their knowledge. The vulnerability requires user interaction and can affect the site's data integrity and availability.
What an attacker can do
Trick a logged-in admin into visiting a malicious page that performs unwanted actions on the site.
Potential impact on your site
Attackers can modify plugin settings or site content if an admin visits a malicious link.
Conditions required to exploit
Admin must visit attacker-controlled page while logged into WordPress.
Key dates
External resources
Related vulnerabilities
