CVE-2024-8090

MEDIUM

JavaScript Logic WP <0.1 - CSRF

Title source: llm

Description

The JavaScript Logic WordPress plugin through 0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.

References (1)

[Exploit, Third Party Advisory] https://wpscan.com/vulnerability/c9dcd450-e8ed-4058-b002-20fb3b879ee0/

Scores

CVSS v3 6.1

EPSS 0.0011

EPSS Percentile 29.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Classification

CWE

CWE-352

Status published

Affected Products (1)

justintadlock/javascript-logic

Timeline

Published May 15, 2025

Tracked Since Feb 18, 2026