Description
The FTP Access WordPress plugin through 1.0 does not have authorisation and CSRF checks when updating its settings and is missing sanitisation as well as escaping in them, allowing any authenticated users, such as subscriber to update them with XSS payloads, which will be triggered when an admin will view the settings of the plugin. The attack could also be perform via CSRF against any authenticated user.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Unknown | FTP Access | affected |
|
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2023-44169 | The FTP Access WordPress plugin through 1.0 does not have authorisation and CSRF checks when updating its settings and is missing sanitisation as well as escaping in them, allowing any authenticated users, such as subscriber to update them with XSS payloads, which will be triggered when an admin will view the settings of the plugin. The attack could also be perform via CSRF against any authenticated user. |
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2024-08-02T06:55:03.467Z
Reserved: 2023-07-04T20:59:31.149Z
Link: CVE-2023-3510
Vulnrichment
No data.
NVD
Status : Modified
Published: 2023-09-11T20:15:10.040
Modified: 2024-11-21T08:17:25.400
Link: CVE-2023-3510
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
No weakness.