CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in Tom Longridge WordPress Error Monitoring by Bugsnag bugsnag allows Stored XSS.This issue affects WordPress Error Monitoring by Bugsnag: from n/a through <= 1.6.3.
Explanation of Vulnerability in Simple Terms
The WordPress Error Monitoring by Bugsnag plugin versions 1.6.3 and earlier are vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious webpage that, when visited by a logged-in WordPress admin, performs unwanted actions on the site without the admin's knowledge or consent. The attack requires the admin to visit the attacker's page while authenticated to WordPress.
What an attacker can do
Perform unwanted actions on the WordPress site by tricking an authenticated admin into visiting a malicious webpage.
Potential impact on your site
An attacker could modify plugin settings, disable error monitoring, or alter site configuration if an admin visits a malicious link.
Conditions required to exploit
Admin must be logged into WordPress and visit an attacker-controlled page; no special plugin configuration required.
Key dates
External resources
