CVE-2021-24685 — Flat Preloader < 1.5.4 - CSRF to Stored Cross-Site Scripting
The Flat Preloader WordPress plugin before 1.5.4 does not enforce nonce checks when saving its settings, as well as does not sanitise and escape them, which could allow attacker…
Published: 2021-11-01 · CVSS: Unscored
The Flat Preloader WordPress plugin before 1.5.4 does not enforce nonce checks when saving its settings, as well as does not sanitise and escape them, which could allow attackers to a make logged in admin change them with a Cross-Site Scripting payload (triggered either in the frontend or backend depending on the payload)
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7