Exploitation Summary
EIP tracks 1 public exploit for CVE-2024-0590. PoCs published by kodaichodai.
AI-analyzed exploit summary This is a functional CSRF PoC for CVE-2024-0590, exploiting a stored XSS vulnerability in the Microsoft Clarity WordPress plugin. The exploit crafts a malicious payload to inject JavaScript via the 'edit_clarity_project_id' action, demonstrating the vulnerability.
Description
The Microsoft Clarity plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9.3. This is due to missing nonce validation on the edit_clarity_project_id() function. This makes it possible for unauthenticated attackers to change the project id and add malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Exploits (1)
This is a functional CSRF PoC for CVE-2024-0590, exploiting a stored XSS vulnerability in the Microsoft Clarity WordPress plugin. The exploit crafts a malicious payload to inject JavaScript via the 'edit_clarity_project_id' action, demonstrating the vulnerability.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N