WordPress Plugin Vulnerabilities

PNG to JPG < 4.1 - Stored Cross-Site Scripting via CSRF

Description

The plugin does not have CSRF check in place when updating its settings, allowing attackers to make a logged in admin do such action via a CSRF attack which could lead to Stored XSS issues due to the lack of sanitisation and escaping in some of them.

Affects Plugins

Plugin icon
png-to-jpg
Fixed in 4.1

References

CVE
CVE-2022-29430

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.7 (medium)

Miscellaneous

Original Researcher
BEE-K
Verified
No
WPVDB ID
b3f0cffe-4adb-4d42-b3c9-009cfebbc522

Timeline

Publicly Published
2022-05-06 (about 4 years ago)
Added
2022-05-21 (about 3 years ago)
Last Updated
2023-02-14 (about 3 years ago)

Other

Published
Title
Published
2023-11-13
Title
WP Blogs' Planetarium <= 1.0 - Settings Update via CSRF
Published
2023-09-04
Title
Live News < 1.07 - Settings Update via CSRF
Published
2015-08-20
Title
WP Google Map Plugin < 3.0.0 - CSRF to Authenticated Cross-Site Scripting (XSS)
Published
2026-01-16
Title
The Guardian News Feed <= 1.2 - Cross-Site Request Forgery to Settings Update
Published
2025-02-03
Title
Theme Options Z <= 1.4 - Cross-Site Request Forgery