Traffic Manager by SedLex <= 1.4.5 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting (XSS)
REPORT ID: 1664739f-6222-4d8f-8348-981e94196c7e
The plugin contains a Missing Authorization vulnerability due to a missing capability check in an AJAX action, which makes it possible for authenticated attackers with a role as low as subscriber to access functionality. The plugin also contains a Cross-Site Scripting (XSS) vulnerability, due to the plugin does not sanitize and escape some parameters, which makes it possible to inject arbitrary web scripts.
You need to log in to view the vulnerability details.
Attributes
- Catgory
- WordPress Plugin
- Vulnerability Discovered
- 2022-09-13
- Report Published
- 2022-10-24
- Affected Version
- <= 1.4.5
Classification
- Type
- Cross-Site Scripting (XSS), Missing Authorization
Support Us?
We would truly appreciate it if you bought us a bunny (food for a snow leopard).
