CVE-2024-8085

Name of the Vulnerable Software and Affected Versions: PeoplePond WordPress plugin versions 1.1.9 and earlier

Description: The issue concerns the lack of CSRF checks in certain areas and missing sanitization as well as escaping in the PeoplePond WordPress plugin. This could allow attackers to make logged-in admins add Stored XSS payloads via a CSRF attack.

Recommendations: For PeoplePond WordPress plugin versions 1.1.9 and earlier, update to a version that includes CSRF checks and proper sanitization and escaping to prevent Stored XSS payloads from being added via CSRF attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.