The BabelZ WordPress plugin through 1.1.5 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/56d22ad0-c5f5-488b-bc1f-73188dfc71d2/ | Exploit Third Party Advisory |
| https://wpscan.com/vulnerability/56d22ad0-c5f5-488b-bc1f-73188dfc71d2/ | Exploit Third Party Advisory |
Configurations
History
27 May 2025, 19:57
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
| References | () https://wpscan.com/vulnerability/56d22ad0-c5f5-488b-bc1f-73188dfc71d2/ - Exploit, Third Party Advisory | |
| CWE | CWE-79 | |
| CPE | cpe:2.3:a:ryanchristenson:babeiz:*:*:*:*:*:wordpress:*:* | |
| First Time |
Ryanchristenson babeiz
Ryanchristenson |
15 May 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-05-15 20:15
Updated : 2025-05-27 19:57
NVD link : CVE-2024-8095
Mitre link : CVE-2024-8095
JSON object : View
Products Affected
ryanchristenson
- babeiz
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')