WordPress Plugin Vulnerabilities

WP Slimstat <= 4.8.3 - CSRF to Stored XSS and Setting Updates

Description

Lack of CSRF check and sanitisation in the update_settings() function can lead to settings update, as well as Stored XSS issues

Proof of Concept

Affects Plugins

Plugin icon
wp-slimstat
Fixed in 4.8.4

References

URL
https://plugins.trac.wordpress.org/changeset/2119485

Miscellaneous

Verified
Yes
WPVDB ID
96f9b0c5-014a-4ccf-a47d-58ba4b5998e5

Timeline

Publicly Published
2019-07-08 (about 6 years ago)
Added
2019-07-08 (about 6 years ago)
Last Updated
2019-07-15 (about 6 years ago)

Other

Published
Title
Published
2019-06-19
Title
Shortlinks by Pretty Links <= 2.1.9 - Stored XSS and CSV Injection
Published
2015-07-07
Title
NewStatPress < 1.0.6 - SQL Injection
Published
2019-10-17
Title
Sliced Invoices < 3.8.4 - Multiple Vulnerabilities
Published
2014-09-17
Title
Google Maps Ready! 1.1.5 - CSRF & XSS
Published
2021-04-13
Title
Video Downloader for TikTok < 1.4 - Server Side Request Forgery (SSRF) & Local File Inclusion (LFI)