Cross-Site Request Forgery and Cross-Site Scripting in Manual Image Crop Plugin for WordPress
CVE-2015-9426

4.6MEDIUM

Key Information:

Vendor: Wordpress
Status: Manual Image Crop
Vendor: CVE Published:; 26 September 2019

What is CVE-2015-9426?

The Manual Image Crop plugin for WordPress versions prior to 1.11 is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability. This flaw allows an attacker to exploit the wp-admin/admin-ajax.php endpoint, manipulating the postId parameter to execute malicious scripts. If successfully exploited, this can result in Cross-Site Scripting (XSS), potentially compromising site security and user integrity.