Skip to content
Sign in
Not rated

CVE-2023-0058 The Tiempo.com WordPress plugin through 0.1.2 does not have CSRF check when creating and editing its shortcode, and is…

Description

The Tiempo.com WordPress plugin through 0.1.2 does not have CSRF check when creating and editing its shortcode, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack

Affected products and versions

Product Affected versions Fixed in
Tiempo.com 0.1 earliest → 0.1.2 No fix stated

Other CVEs of Tiempo.com

The 3 CVEs of Tiempo.com →
CVE-2023-2272 The Tiempo.com WordPress plugin through 0.1.2 does not sanitise and escape the page parameter before outputting it… Not rated CVE-2023-2271 The Tiempo.com WordPress plugin through 0.1.2 does not have CSRF check when deleting its shortcode, which could allow… Not rated
Track this CVE