Skip to content
Sign in
4.6 Medium

CVE-2024-13096 The WP Finance WordPress plugin through 1.3.6 does not have CSRF check in some places, and is missing sanitisation as…

Description

The WP Finance WordPress plugin through 1.3.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.

Affected products and versions

Product Affected versions Fixed in
WP Finance 1.3 earliest → 1.3.6 No fix stated

Other CVEs of WP Finance

The 2 CVEs of WP Finance →
CVE-2024-13097 The WP Finance WordPress plugin through 1.3.6 does not sanitise and escape a parameter before outputting it back in… 5.4 Medium
Track this CVE