Bob Matyas
·
Published
2025-02-04
·
Updated
2025-05-07
·
CVE-2024-13115
6.1
Medium
| Base vector | Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions:
WP Projects Portfolio with Client Testimonials WordPress plugin versions 3.0 and earlier
Description:
The issue concerns the lack of CSRF check in some places, as well as missing sanitisation and escaping, which could allow attackers to make logged-in admins add Stored XSS payloads via a CSRF attack. This could potentially enable attackers to inject malicious code into the application.
Recommendations:
For WP Projects Portfolio with Client Testimonials WordPress plugin versions 3.0 and earlier, consider disabling the plugin until a patch is available to prevent potential exploitation. Restrict access to the plugin's functionality to minimize the risk of CSRF and XSS attacks. Avoid using the plugin for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
CSRF