Posted by Evex ola on May 08

‘Yet Another Related Posts Plugin’ options can be updated with no
token/nonce protection which an attacker may exploit via tricking website’s
administrator to enter a malformed page which will change YARPP options,
and since some options allow html the attacker is able to inject malformed
javascript code which can lead to code execution/administrator actions when
the injected code is triggered by an admin user.
injected javascript…