CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in www.15.to QR Code Tag for WC qr-code-tag-for-wc-from-goaskle-com allows Cross Site Request Forgery.This issue affects QR Code Tag for WC: from n/a through <= 1.9.42.
Explanation of Vulnerability in Simple Terms
QR Code Tag for WC versions up to 1.9.42 are vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious link or page that, when visited by a logged-in site administrator, performs unwanted actions on the site without their knowledge. The vulnerability requires user interaction—the admin must click the link or visit the attacker's page. No sensitive data is exposed, but site settings or data could be modified.
What an attacker can do
Trick a logged-in admin into performing unwanted actions via a malicious link or page.
Potential impact on your site
An attacker can modify plugin settings or data if an admin is tricked into clicking a malicious link.
Conditions required to exploit
Admin must click a malicious link or visit an attacker-controlled page while logged in.
Key dates
External resources
Related vulnerabilities
