Unrated severityNVD Advisory· Published Aug 5, 2021· Updated Sep 17, 2024

NewsPlugin <= 1.0.18 - Cross-Site Request Forgery to Stored Cross-Site Scripting

CVE-2021-34631

Description

The NewsPlugin WordPress plugin is vulnerable to Cross-Site Request Forgery via the handle_save_style function found in the ~/news-plugin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.18.

Affected products

WordPress/NewsPluginllm-create
Range: <=1.0.18
NewsPlugin/NewsPluginv5
Range: 1.0.18

Patches

Vulnerability mechanics

References

www.wordfence.com/vulnerability-advisories/mitrex_refsource_MISC

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000