CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in elfsight Elfsight Testimonials Slider elfsight-testimonials-slider allows Cross Site Request Forgery.This issue affects Elfsight Testimonials Slider: from n/a through <= 1.0.1.
Explanation of Vulnerability in Simple Terms
Elfsight Testimonials Slider versions up to 1.0.1 contain a cross-site request forgery (CSRF) vulnerability. An attacker can craft a malicious webpage that, when visited by a site administrator, performs unwanted actions on the site without their knowledge. The vulnerability requires the admin to visit the attacker's page while logged into their site. No authentication bypass or data theft occurs, but the attacker can modify site settings or content.
What an attacker can do
Trick a logged-in admin into performing unwanted actions on the site by visiting a malicious webpage.
Potential impact on your site
An attacker can modify testimonial slider settings or content if an admin visits a malicious link.
Conditions required to exploit
Admin must visit attacker-controlled webpage while logged into the site.
Key dates
External resources
