Skip to content
OpenAdvisories
Medium · 6.3 CVE-2024-8243 EUVD-2025-10542GHSA-c846-2c33-mpmm

Plugin Upgrade Time Out <= 1.0 - Stored XSS via CSRF

Published Apr 9, 2025 · Updated Apr 9, 2025 · Assigned by WPScan

Category: Web / CMS

Description

The WordPress/Plugin Upgrade Time Out Plugin WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.

Affected products

VendorProductAffectedFixed
— WordPress/Plugin Upgrade Time Out Plugin ≤ 1.0 —

References