Description
The Flat Preloader WordPress plugin before 1.5.4 does not enforce nonce checks when saving its settings, as well as does not sanitise and escape them, which could allow attackers to a make logged in admin change them with a Cross-Site Scripting payload (triggered either in the frontend or backend depending on the payload)
References (1)
Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/972ecde8-3d44-4dd9-81e3-643d8737434f
Scores
CVSS v3
5.4
EPSS
0.0049
EPSS Percentile
38.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Details
CWE
CWE-352
CWE-79
Status
published
Products (1)
flat_preloader_project/flat_preloader
< 1.5.4
Published
Nov 01, 2021
Tracked Since
Feb 18, 2026