Description (CNA)
The Wp Cookie Choice WordPress plugin through 1.1.0 is lacking any CSRF check when saving its options, and do not escape them when outputting them in attributes. As a result, an attacker could make a logged in admin change them to arbitrary values including XSS payloads via a CSRF attack.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Unknown / Wp Cookie Choice | affected 1.1.0 through 1.1.0 |
CWE
CWE-352, CWE-79
References
ADP enrichment
No English description supplied.