CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in Eli EZ SQL Reports Shortcode Widget and DB Backup elisqlreports allows Stored XSS.This issue affects EZ SQL Reports Shortcode Widget and DB Backup: from n/a through <= 5.25.08.
Explanation of Vulnerability in Simple Terms
EZ SQL Reports Shortcode Widget and DB Backup versions 5.25.08 and earlier are vulnerable to cross-site request forgery (CSRF). An attacker can trick a site administrator into performing unwanted actions—such as modifying reports, changing settings, or triggering backups—by crafting a malicious link or page. The vulnerability requires the admin to visit the attacker's page while logged into WordPress.
What an attacker can do
Trick an admin into performing unwanted actions like modifying reports, changing settings, or triggering backups without their knowledge.
Potential impact on your site
An attacker could alter your reports, backup settings, or database configuration if they trick you into visiting a malicious page while logged in.
Conditions required to exploit
Admin must be logged into WordPress and visit a page controlled by the attacker (e.g., click a malicious link).
Key dates
External resources
