aBitGone CommentSafe WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the aBitGone CommentSafe WordPress plugin, affecting versions through 1.0.0. The vulnerability arises because the plugin lacks proper CSRF checks in certain areas and fails to adequately sanitize and escape data. This could enable attackers to exploit logged-in administrators by having them unknowingly add Stored Cross-Site Scripting (XSS) payloads, creating a persistent security issue.

Impact

Exploitation of this vulnerability allows for Cross-Site Request Forgery, where an attacker can trick a user into performing actions they did not intend to, potentially leading to the injection of malicious scripts that are stored and executed in the context of the user.