Wpmobi
Monthly
Cross-Site Request Forgery combined with reflected XSS in the WpMobi WordPress plugin (all versions through 0.0.3) allows unauthenticated attackers to execute arbitrary JavaScript in an administrator's browser session by forging a settings-save request. The handleSaveGeneralSettings function performs no nonce validation, permitting any remote party to submit crafted plugin settings on behalf of an authenticated admin. A particularly notable aspect is that the injected script in the app_name parameter fires even when server-side validation rejects the value, because the view layer re-renders the form with the unsanitized in-memory value rather than a sanitized fallback - meaning the XSS trigger does not depend on successful data persistence. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-Site Request Forgery combined with reflected XSS in the WpMobi WordPress plugin (all versions through 0.0.3) allows unauthenticated attackers to execute arbitrary JavaScript in an administrator's browser session by forging a settings-save request. The handleSaveGeneralSettings function performs no nonce validation, permitting any remote party to submit crafted plugin settings on behalf of an authenticated admin. A particularly notable aspect is that the injected script in the app_name parameter fires even when server-side validation rejects the value, because the view layer re-renders the form with the unsanitized in-memory value rather than a sanitized fallback - meaning the XSS trigger does not depend on successful data persistence. No public exploit code or CISA KEV listing has been identified at time of analysis.