title: Student Result or Employee Database < 1.7.5 - Stored Cross Site Scripting via CSRF
description: The Student Result or Employee Database WordPress plugin before 1.7.5 does not have CSRF in its AJAX actions, allowing attackers to make logged in user with a role as low as contributor to add/edit and delete students via CSRF attacks. Furthermore, due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site scripting
problem types: CWE-639 Authorization Bypass Through User-Controlled Key
affected:
{
product: Student Result or Employee Database
vendor: Unknown
versions:
lessThan: 1.7.5, status: affected, version: 1.7.5, versionType: custom
}