CVE-2023-3356
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The Subscribers Text Counter plugin for WordPress before version 1.7.1 lacks CSRF checks when updating its settings, allowing attackers to change them via a logged-in admin. The absence of sanitization and escaping also leads to the potential for Stored Cross-Site Scripting.
Risk Assessment
The lack of proper security measures may allow unauthorized changes to the plugin settings by attackers, threatening the integrity of the system. Additionally, the possibility of Stored XSS poses risks to users visiting compromised sites.
Recommendation
It is recommended to update the plugin to version 1.7.1 or later to mitigate the security vulnerability. Furthermore, implementing additional security mechanisms against CSRF attacks is advisable.
Original NVD description (English source)
The Subscribers Text Counter WordPress plugin before 1.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, which also lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping