Cross-Site Request Forgery in Banner Effect Header for WordPress
CVE-2015-0920

Currently unrated

Key Information:

Vendor
Wordpress
Status
Banner Effect Header
Vendor
CVE Published:
8 January 2015

Summary

A CSRF vulnerability exists in the Banner Effect Header plugin version 1.2.6 for WordPress, enabling remote attackers to exploit the plugin by hijacking the authentication of administrators. This can be achieved through crafted requests that utilize the 'banner_effect_email' parameter on the BannerEffectOptions page, potentially leading to cross-site scripting (XSS) attacks and compromising the site's security.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/99613
vdb-entryx_refsource_XF
https://exchange.xforce.ibmcloud.com/vulnerabilities/99614
vdb-entryx_refsource_XF
http://packetstormsecurity.com/files/129804/WordPress-Ban...
x_refsource_MISC

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.