WordPress Plugin Vulnerabilities

Footer Text <= 2.0.3 - Stored Cross-Site Scripting via CSRF

Description

The plugin does not have CSRF in place when updating its settings, and is lacking sanitisation as well as escaping in them, which could allow attackers to make a logged in admin change them and perform Cross-Site Scripting attacks

Affects Plugins

Plugin icon
footer-text
No known fix

References

CVE
CVE-2022-27860

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
Rasi Afeef
Verified
Yes
WPVDB ID
8202289f-5d42-4da2-9563-cbfd0edae4bd

Timeline

Publicly Published
2022-04-28 (about 4 years ago)
Added
2022-04-28 (about 4 years ago)
Last Updated
2022-04-29 (about 4 years ago)

Other

Published
Title
Published
2019-05-26
Title
Affiliates Manager < 2.6.6 - CRSF Issues
Published
2025-01-07
Title
JK Html To Pdf <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2023-03-08
Title
HT Easy GA4 ( Google Analytics 4 ) < 1.0.7 - Plugin Activation via CSRF
Published
2021-07-12
Title
Advanced Menu Manager < 3.0 - Unauthorised Menu Edition via CSRF
Published
2025-01-23
Title
Automate Hub Free by Sperse.IO <= 1.7.0 - Cross-Site Request Forgery to Activation Status Update