CVE-2024-12282: WordPress连接微博 <= 2.5.6 - Stored XSS via CSRF
The WordPress连接微博 WordPress plugin through 2.5.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12282?
CVE-2024-12282 is classified as a medium severity vulnerability due to its potential for exploiting Cross-Site Request Forgery (CSRF) to deploy stored XSS attacks.
How do I fix CVE-2024-12282?
To fix CVE-2024-12282, update the WordPress连接微博 plugin to the latest version that includes CSRF checks and proper input sanitization.
What are the risks associated with CVE-2024-12282?
The risks associated with CVE-2024-12282 include the potential for attackers to exploit CSRF to inject stored XSS payloads, compromising admin accounts.
Which versions of the WordPress连接微博 plugin are affected by CVE-2024-12282?
All versions of the WordPress连接微博 plugin up to and including 2.5.6 are affected by CVE-2024-12282.
Can CVE-2024-12282 be exploited remotely?
Yes, CVE-2024-12282 can be exploited remotely if an attacker can trick an authenticated admin user into executing the malicious CSRF payload.