6.1
CVE-2022-3149
- EPSS 0.09%
- Veröffentlicht 17.10.2022 12:15:10
- Zuletzt bearbeitet 14.05.2025 16:15:22
- Quelle contact@wpscan.com
- CVE-Watchlists
- Unerledigt
LoginWP Custom Cursors <= 3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
The WP Custom Cursors WordPress plugin before 3.0.1 does not have CSRF check in place when creating and editing cursors, which could allow attackers to made a logged in admin perform such actions via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping in some of the cursor options, it could also lead to Stored Cross-Site Scripting
Mögliche Gegenmaßnahme
WP Custom Cursors | WordPress Cursor Plugin: Update to version 3.0.1, or a newer patched version
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt
WP Custom Cursors | WordPress Cursor Plugin
Version
*-3.0
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Wp Custom Cursors Project ≫ Wp Custom Cursors SwPlatformwordpress Version < 3.0.1
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.09% | 0.27 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 6.1 | 2.8 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | 6.1 | 2.8 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
|
CWE-352 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.