CVE-2024-8243

Plugin Upgrade Time Out <= 1.0 - Stored XSS via CSRF

CVSS 6.3 MEDIUMEPSS 0.1%

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 6.3EPSS 0.1%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

09 Apr 2025Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

The WordPress/Plugin Upgrade Time Out Plugin WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Affected products

Unknown · WordPress/Plugin Upgrade Time Out Plugin

References

https://wpscan.com/vulnerability/8e1e2d8d-41aa-49bc-95d5-dae75be788d5/