Apuslisting
Monthly
Cross-Site Request Forgery in the ApusListing WordPress theme (versions 1.2.63 and earlier) lets a remote, unauthenticated attacker forge privileged state-changing requests that a logged-in victim's browser executes, chaining into a broken-authentication condition that can lead to account or session compromise. Reported by Patchstack and rated CVSS 8.8, exploitation requires tricking an authenticated user into visiting attacker-controlled content (UI:R). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Cross-Site Request Forgery in the ApusListing WordPress theme (versions 1.2.63 and earlier) lets a remote, unauthenticated attacker forge privileged state-changing requests that a logged-in victim's browser executes, chaining into a broken-authentication condition that can lead to account or session compromise. Reported by Patchstack and rated CVSS 8.8, exploitation requires tricking an authenticated user into visiting attacker-controlled content (UI:R). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.