CVE-2023-3492 | BDVDB-2026-208778 Detail

WP Shopping Pages

Description#

The WP Shopping Pages WordPress plugin through 1.14 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-352 Cross-Site Request Forgery (CSRF)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

References#

https://wpscan.com/vulnerability/01b9b1c2-439e-44df-bf01-026cb13d7d40

Exploit#

https://wpscan.com/vulnerability/01b9b1c2-439e-44df-bf01-026cb13d7d40

History#

Version 12023-08-07Record published in the CVE List.
Version 22024-08-02Most recent update recorded in the CVE List.