WordPress Hermit 音乐播放器 plugin <= 3.1.6 - Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) vulnerability
CVE-2022-29413

4.7MEDIUM

Key Information:

Vendor: Wordpress
Status: Hermit 音乐播放器 (WordPress Plugin)
Vendor: CVE Published:; 28 April 2022

Summary

Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) in Mufeng's Hermit 音乐播放器 plugin <= 3.1.6 on WordPress via &title parameter.

Affected Version(s)

Hermit 音乐播放器 (WordPress plugin) <= 3.1.6 <= 3.1.6

References

https://wordpress.org/plugins/hermit/

x_refsource_CONFIRM

https://patchstack.com/database/vulnerability/hermit/word...

x_refsource_CONFIRM

CVSS V3.1

Score:

4.7

Severity:

MEDIUM

Confidentiality:

None

Integrity:

Low

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Changed

Timeline

Vulnerability published
Apr 28, 2022
Vulnerability Reserved
Apr 18, 2022

Credit

Vulnerability discovered by Ex.Mi (Patchstack)