WP Finance WordPress Plugin Stored Cross-Site Scripting Vulnerability via CSRF

A stored cross-site scripting vulnerability has been identified in the WP Finance WordPress plugin, affecting versions through 1.3.6. The issue arises from the plugin's lack of proper cross-site request forgery (CSRF) checks in certain areas, combined with inadequate data sanitization and escaping. This vulnerability could enable attackers to exploit logged-in administrators by injecting malicious scripts that are stored and executed later.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.