WordPress Plugin Vulnerabilities

Image Map Pro – Drag-and-drop Builder for Interactive Images – Lite < 1.0.0 - CSRF to Stored XSS

Description

The plugin does not have CSRF checks in place when saving its settings, and do not sanitise or escape them before outputting them back in the page, leading to a stored Cross-Site Scripting issue via a CSRF attack

Affects Plugins

Plugin icon
image-map-pro-lite
No known fix

References

CVE
CVE-2023-3411

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
Kenichiro Ito
Verified
No
WPVDB ID
d6a888de-7535-4da5-9498-f2612683fb66

Timeline

Publicly Published
2023-06-26 (about 2 years ago)
Added
2023-06-27 (about 2 years ago)
Last Updated
2023-06-27 (about 2 years ago)

Other

Published
Title
Published
2024-11-10
Title
Connexion Logs <= 3.0.2 - Log Deletion via CSRF
Published
2023-10-26
Title
Thumbnail carousel slider < 1.0.1 - Cross-Site Request Forgery to Mass Slider Deletion
Published
2024-11-01
Title
Mobilize <= 3.0.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Published
2025-08-22
Title
WP Fast Total Search < 1.79.274 - Cross-Site Request Forgery
Published
2025-02-24
Title
Smart Maintenance & Countdown <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting