Description
The Progressive License WordPress plugin through 1.1.0 is lacking any CSRF check when saving its settings, which could allow attackers to make a logged in admin change them. Furthermore, as the plugin allows arbitrary HTML to be inserted in one of the settings, this could lead to Stored XSS issue which will be triggered in the frontend as well.
References (1)
Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/11937296-7ecf-4b94-b274-06f7990dbede
Scores
CVSS v3
5.4
EPSS
0.0026
EPSS Percentile
16.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-352
Status
published
Products (1)
crowdfavorite/progressive_license
< 1.1.0
Published
Aug 01, 2022
Tracked Since
Feb 18, 2026