CVE-2019-11869

The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that is_admin() verifies that the request comes from an admin user…

published May 9, 2019

CVSS
—
EPSS
4%
Percentile
91.4
In the wild
Unconfirmed
What it is

The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that is_admin() verifies that the request comes from an admin user (it actually only verifies that the request is for an admin page). An unauthenticated attacker can inject a payload into the plugin settings, such as the yuzo_related_post_css_and_style setting.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04483 · 91.4th percentile
Published
2019-05-09T21:24Z
EPSS history
Timeline
  • 09 MAY 21:24Z
    The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that is_admin() verifies that the request comes from an admin user…
    cvelistv5