PT-2023-16393 · WordPress · Sloth Logo Customizer
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Sloth Logo Customizer WordPress plugin versions prior to 2.0.3
Description
The issue concerns a lack of CSRF check when updating settings, as well as missing sanitization and escaping. This could allow attackers to make logged-in admins add Stored XSS payloads via a CSRF attack.
Recommendations
For Sloth Logo Customizer WordPress plugin versions prior to 2.0.3, update to version 2.0.3 or later to resolve the issue.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Sloth Logo Customizer