404 SEO Redirection <= 1.3 - CSRF to Stored Cross-Site Scripting (XSS)
Description
The plugin is lacking CSRF checks in all its settings, allowing attackers to make a logged in user change the plugin's settings. Due to the lack of sanitisation and escaping in some fields, it could also lead to Stored Cross-Site Scripting issues
Proof of Concept
The PoC will be displayed once the issue has been remediated
Affects Plugins
No known fix - plugin closed
References
YouTube Video
Classification
Miscellaneous
Timeline
Publicly Published
2021-04-16 (about 3 months ago)
Added
2021-04-27 (about 2 months ago)
Last Updated
2021-05-18 (about 2 months ago)