Newspaper Theme 6.4–6.7.1 - Privilege Escalation
The newspaper theme before 6.7.2 for WordPress has a lack of options access control via td_ajax_update_panel.
newspaperPoC 已收录
CVSS9.8
共找到 2 条公开漏洞记录
The newspaper theme before 6.7.2 for WordPress has a lack of options access control via td_ajax_update_panel.
WordPress Newspaper theme before 12 is susceptible to cross-site scripting. The does not sanitize a parameter before outputting it back in an HTML attribute via an AJAX action. An attacker can potentially execute malware, obtain sensitive information, modify data, and/or execute unauthorized operations without entering necessary credentials.