WordPress Plugin Vulnerabilities

ImageMapper <= 1.2.6 - Stored XSS via CSRF

Description

The plugin does not have CSRF check in its imgmap_save_area_title function, which could allow attackers to make logged in admins update arbitrary post titles with XSS payloads via a CSRF attack

Affects Plugins

Plugin icon
imagemapper
No known fix

References

CVE
CVE-2023-5532

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
7.1 (high)

Miscellaneous

Original Researcher
Lana Codes
Verified
No
WPVDB ID
9345821f-0ddc-4f31-9ed4-3ac4c79bcbf6

Timeline

Publicly Published
2023-11-06 (about 2 years ago)
Added
2023-11-16 (about 2 years ago)
Last Updated
2023-11-16 (about 2 years ago)

Other

Published
Title
Published
2025-10-08
Title
WP Go Maps (formerly WP Google Maps) < 9.0.47 - Cross-Site Request Forgery to Plugin Settings Update
Published
2025-04-18
Title
KiotViet Sync <= 1.8.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2025-01-16
Title
go Social <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2025-11-05
Title
Easy Email Subscription < 1.3.1 - Cross-Site Request Forgery to Arbitrary Subscriber Deletion
Published
2025-03-24
Title
External image replace <= 1.0.8 - Cross-Site Request Forgery to Settings Update