CVE-2017-14530

HIGH

Crony Cronjob Manager < 0.4.6 - Cross-Site Request Forgery via Name Parameter

Title source: llm

Description

WP_Admin_UI in the Crony Cronjob Manager plugin before 0.4.7 for WordPress has CSRF via the name parameter in an action=manage&do=create operation, as demonstrated by inserting XSS sequences.

References (3)

Core 3

Core References

Third Party Advisory x_refsource_misc

https://wordpress.org/plugins/crony/#developers

Exploit, Technical Description, Third Party Advisory x_refsource_misc

https://github.com/cybersecurityworks/Disclosed/issues/9

Exploit, Third Party Advisory x_refsource_misc

https://cybersecurityworks.com/zerodays/cve-2017-14530-crony.html

Scores

CVSS v3 8.0

EPSS 0.0066

EPSS Percentile 47.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-352

Status published

Products (1)

crony_cronjob_manager_project/crony_cronjob_manager < 0.4.6

Published Sep 18, 2017

Tracked Since Feb 18, 2026