CVE-2024-3823
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The Base64 Encoder/Decoder WordPress plugin through version 0.9.2 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged-in admin add Stored XSS payloads via a CSRF attack.
Risk Assessment
An attacker can use CSRF to inject malicious scripts that execute in other users' browsers, potentially leading to session theft, redirects, or data theft.
Recommendation
Update the Base64 Encoder/Decoder plugin to the latest version or implement proper CSRF protections and input sanitization.
Original NVD description (English source)
The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack