CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
CVE-2024-13096: WP Finance <= 1.3.6 - Stored XSS via CSRF
4.6
CVSS
Description
The WP Finance WordPress plugin through 1.3.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.
Classification
CVE ID: CVE-2024-13096
CVSS Base Severity: MEDIUM
CVSS Base Score: 4.6
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Affected Products
Vendor: Unknown
Product: WP Finance
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.04% (probability of being exploited)
EPSS Percentile: 11.76% (scored less or equal to compared to others)
EPSS Date: 2025-03-02 (when was this score calculated)