title: Five Star Business Profile and Schema < 2.1.7 - Subscriber+ Page Creation & Settings Update to Stored XSS
description: The Five Star Business Profile and Schema WordPress plugin before 2.1.7 does not have any authorisation and CSRF in its bpfwp_welcome_add_contact_page and bpfwp_welcome_set_contact_information AJAX action, allowing any authenticated users, such as subscribers, to call them. Furthermore, due to the lack of sanitisation, it also lead to Stored Cross-Site Scripting issues
problem types: CWE-79 Cross-site Scripting (XSS)
affected:
{
product: Five Star Business Profile and Schema
vendor: Unknown
versions:
lessThan: 2.1.7, status: affected, version: 2.1.7, versionType: custom
}