The Subscribers Text Counter WordPress plugin prior to 1.7.1 does not have CSRF check in place when updating its settings, which could allow malicious users to make a logged in admin change them via a CSRF attack, which also lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
kreci subscribers text counter |
Vulmon