FraudLabs Pro SMS Verification Vulnerable to Cross-Site Request Forgery (CSRF) and Stored XSS Attacks
CVE-2024-51688

7.1HIGH

Key Information:

Vendor

WordPress
Status
Fraudlabs Pro Sms Verification
Vendor
CVE Published:
14 November 2024

What is CVE-2024-51688?

A Cross-Site Request Forgery (CSRF) vulnerability exists in the FraudLabs Pro SMS Verification plugin that could allow an attacker to perform unauthorized actions on behalf of users. This flaw also leads to the potential for Stored Cross-Site Scripting (XSS) attacks, compromising the security of web applications by injecting malicious scripts into content served to users. Affected versions include all prior to 1.10.1. It is essential for users to update to the latest version to mitigate risks associated with this vulnerability.

Affected Version(s)

FraudLabs Pro SMS Verification 0 <= 1.10.1

References

https://patchstack.com/database/Wordpress/Plugin/fraudlab...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.