Cross-Site Request Forgery Vulnerability in WP Legal Pages Plugin for WordPress
CVE-2015-9428

6.5MEDIUM

Key Information:

Vendor: Wordpress
Status: WP Legal Pages
Vendor: CVE Published:; 26 September 2019

What is CVE-2015-9428?

The WP Legal Pages plugin for WordPress, prior to version 1.1, is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability that can result in Cross-Site Scripting (XSS) attacks. An attacker can exploit this vulnerability by crafting a malicious request that manipulates parameters such as lp-domain-name, lp-business-name, lp-phone, lp-street, lp-city-state, lp-country, lp-email, lp-address, or lp-niche, leading to potential unauthorized actions and execution of harmful scripts in the context of the user's session.