VM Backups <= 1.0 - CSRF to Stored Cross-Site Scripting (XSS)
Description
The plugin does not have CSRF checks, allowing attackers to make a logged in user unwanted actions, such as update the plugin's options, leading to a Stored Cross-Site Scripting issue.
Proof of Concept
The PoC will be displayed once the issue has been remediated
Affects Plugins
No known fix - plugin closed
References
Classification
Miscellaneous
Original Researcher
0xB9
Submitter twitter
Verified
Yes
Timeline
Publicly Published
2021-03-13 (about 6 months ago)
Added
2021-03-13 (about 6 months ago)
Last Updated
2021-03-15 (about 6 months ago)