Filtered by vendor Wpeden
Subscriptions
Filtered by product Shiny Buttons
Subscriptions
Total
1 CVE
CVE | Vendors | Products | Updated | CVSS v3.1 |
---|---|---|---|---|
CVE-2021-24792 | 1 Wpeden | 1 Shiny Buttons | 2024-11-21 | 6.1 Medium |
The Shiny Buttons WordPress plugin through 1.1.0 does not have any authorisation and CSRF in place when saving a template (wpbtn_save_template function hooked to the init action), nor sanitise and escape them before outputting them in the admin dashboard, which allow unauthenticated users to add a malicious template and lead to Stored Cross-Site Scripting issues. |
Page 1 of 1.