← CVE Intelligence

CVE-2023-3356

Subscribers Text Counter < 1.7.1 - Settings Update via CSRF to Stored XSS PUBLISHED

Description (CNA)

The Subscribers Text Counter WordPress plugin before 1.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, which also lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping

Affected (CNA)

Vendor / productVersions
Unknown / Subscribers Text Counteraffected 0 before 1.7.1

CWE

No CWE identifiers supplied.

References

ADP enrichment

CVE

No English description supplied.

CISA-ADP

No English description supplied.

No references supplied.