Threats tagged 'ghsa-c9cf-gx4r-55f7'

The Pagerank Tools plugin for WordPress up to version 1.1.5 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via Cross-Site Request Forgery (CSRF). The vulnerability arises from missing nonce validation and insufficient input sanitization in the pr_save_settings() function. An unauthenticated attacker can exploit this by tricking an administrator into clicking a malicious link, causing malicious scripts to be stored and executed when the plugin's settings page is accessed.