The Stetic WordPress plugin is vulnerable to Cross-Site... · CVE-2021-42364 · GitHub Advisory Database · GitHub

The Stetic WordPress plugin is vulnerable to Cross-Site...

High severity Unreviewed Published Nov 30, 2021 to the GitHub Advisory Database • Updated Feb 1, 2023

Package

No package listed— Suggest a package

Affected versions

Unknown

Patched versions

Unknown

Description

The Stetic WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the stats_page function found in the ~/stetic.php file, which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 1.0.6.

References

Published by the National Vulnerability Database

Nov 29, 2021

Published to the GitHub Advisory Database Nov 30, 2021

Last updated Feb 1, 2023