Admin Custom Login, 5c6d99f4286a034c6e844d06e8fc7adc3ad35074

CVE, Research URL: 5c6d99f4286a034c6e844d06e8fc7adc3ad35074
Home page URL: Security reports for Admin Custom Login
Application: Admin Custom Login
Published on: Mar 01, 2017
Research Description: Admin Custom Login [admin-custom-login] < 2.4.8 Admin Custom Login <= 2.4.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting The Admin Custom Login plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting via the ‘logo_url’ parameter in versions before 2.4.8 due to insufficient input sanitization and output escaping and missing nonce validation. This makes it possible for unauthenticated attackers to inject malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected versions: max 2.4.8.
Status: vulnerable