CVE-2024-3823: Base64 Encoder/Decoder <= 0.9.2 - Stored XSS via CSRF
The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3823?
CVE-2024-3823 is considered a high severity vulnerability due to its potential to allow stored XSS via CSRF attacks.
How do I fix CVE-2024-3823?
To fix CVE-2024-3823, update the Base64 Encoder/Decoder WordPress plugin to the latest version, which includes patches for these vulnerabilities.
What kind of attacks can CVE-2024-3823 exploit?
CVE-2024-3823 can be exploited through CSRF attacks that allow logged-in admins to unintentionally add stored XSS payloads.
Which versions of the Base64 Encoder/Decoder plugin are affected by CVE-2024-3823?
CVE-2024-3823 affects the Base64 Encoder/Decoder WordPress plugin versions up to and including 0.9.2.
Does CVE-2024-3823 require user interaction to exploit?
CVE-2024-3823 can be exploited without direct user interaction since it relies on CSRF to execute malicious actions.