WordPress Plugin Vulnerabilities

Login Screen Manager <= 3.5.2 - Stored XSS via CSRF

Description

The plugin does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack

Affects Plugins

Plugin icon
login-screen-manager
No known fix

References

CVE
CVE-2023-47182

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
Nano
Verified
No
WPVDB ID
fc9cb6de-bcc1-419a-81bd-be3de6018471

Timeline

Publicly Published
2023-10-31 (about 2 years ago)
Added
2023-11-17 (about 2 years ago)
Last Updated
2023-11-17 (about 2 years ago)

Other

Published
Title
Published
2025-12-12
Title
Custom Frames <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Parameter
Published
2024-09-27
Title
Chartify < 2.7.7 - Reflected Cross-Site Scripting
Published
2024-05-13
Title
140+ Widgets | Best Addons For Elementor – FREE < 1.4.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
Published
2022-05-09
Title
Birthdays Widget <= 1.7.18 - Admin+ Stored Cross Site Scripting
Published
2024-12-11
Title
FloristPress < 7.3.0 - Reflected Cross-Site Scripting