WordPress Duplicate Page or Post <1.5.1 - Cross-Site Scripting
WordPress Duplicate Page or Post plugin before 1.5.1 contains a stored cross-site scripting vulnerability. The plugin does not have any authorization and has a flawed cross-site request forgery check in the wpdevart_duplicate_post_parametrs_save_in_db AJAX action, allowing unauthenticated users to call it and change the plugin's settings, or perform such attack via cross-site request forgery.
duplicate_page_or_postPoC 已收录
CVSS3.5EPSS 9.9%