WordPress Plugin Name: GMO Social Connection plugin <= 1.2 - CSRF to Stored Cross Site Scripting (XSS) vulnerability
CVE-2024-51636

7.1HIGH

Key Information:

Vendor
WordPress
Status
Gmo Social Connection
Vendor
CVE Published:
19 November 2024

Summary

A Cross-Site Request Forgery (CSRF) vulnerability exists in the GMO Social Connection plugin, which can potentially lead to Cross-Site Scripting (XSS) attacks. This vulnerability allows an unauthorized attacker to trick users into executing unwanted actions on a web application where they are authenticated. The affected versions of the GMO Social Connection plugin range from n/a to 1.2, posing a significant risk to users due to the potential compromise of sensitive data and unauthorized actions performed on behalf of legitimate users.

Affected Version(s)

GMO Social Connection <= 1.2

References

https://patchstack.com/database/vulnerability/gmo-social-...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

Credit

Joshua Chan (Patchstack Alliance)
.