CVE-2019-11886
High
Description
The WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) plugin before 7.2.1 for WordPress allows yp_option_update CSRF, as demonstrated by use of yp_remote_get to obtain admin access.
SeverityHigh
CVSS8.8
Exploit probability—
ProductYellowpencil Visual Css Style Editor
PublishedMay 13, 2019
First seenMay 13, 2019
How to fix
Update
- yellowpencil visual_css_style_editor7.2.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| yellowpencil visual_css_style_editor | v < 7.2.1 | 7.2.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.