WordPress连接微博 Stored Cross-Site Scripting Vulnerability via Cross-Site Request Forgery

A stored cross-site scripting vulnerability has been identified in the WordPress连接微博 plugin, affecting versions through 2.5.6. The issue arises because the plugin lacks proper cross-site request forgery (CSRF) checks in certain areas and fails to adequately sanitize and escape data. This combination could enable attackers to exploit CSRF vulnerabilities, potentially leading to the injection of malicious scripts that are stored and executed later.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.