CVE-2019-11886

HOCH 8.8CVE-2019-11886 · Published 13/05/2019 · updated 17/06/2026

Kurz gesagt

CVE-2019-11886 ist eine Schwachstelle (HOCH (CVSS 8.8)) in visual css style editor (yellowpencil).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 2.3%, höher als bei 83.2% aller Schwachstellen.
Abhilfe: auf 7.2.1 oder neuer aktualisieren.

Package	Affected versions	Patched versions
visual css style editor yellowpencil	`< 7.2.1`	`7.2.1`

Description

The WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) plugin before 7.2.1 for WordPress allows yp_option_update CSRF, as demonstrated by use of yp_remote_get to obtain admin access.

References

wordpress.org/plugins/yellow-pencil-visual-theme-customizer · Release Notes
wpvulndb.com/vulnerabilities/9256
pluginvulnerabilities.com/2019/04/09/recently-closed-visual-css-style-editor-wordpress-plugin-contains-privilege-escalation-vulnerability-that-leads-to-option-update-vulnerability
wordfence.com/blog/2019/04/zero-day-vulnerability-in-yellow-pencil-visual-theme-customizer-exploited-in-the-wild · Exploit

Weitere Schwachstellen in visual css style editor

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free