Description (CNA)
The WP-PostRatings WordPress plugin before 1.86.1 does not sanitise the postratings_image parameter from its options page (wp-admin/admin.php?page=wp-postratings/postratings-options.php). Even though the page is only accessible to administrators, and protected against CSRF attacks, the issue is still exploitable when the unfiltered_html capability is disabled.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Unknown / WP-PostRatings | affected 0 before 1.86.1 |
CWE
No CWE identifiers supplied.
References
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.