CVE-2023-3492
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
The WP Shopping Pages plugin for WordPress through version 1.14 lacks CSRF checks in some places and is missing sanitization and escaping, which could allow attackers to make logged in admins add Stored XSS payloads via a CSRF attack.
Risk Assessment
The lack of proper security measures may lead to the introduction of malicious code by attackers, jeopardizing data security and system integrity.
Recommendation
It is recommended to update the plugin to the latest version and implement additional security mechanisms against CSRF attacks.
Original NVD description (English source)
The WP Shopping Pages WordPress plugin through 1.14 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.