CVE-2015-9428: Wplegalpages Wp Legal Pages

Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days.

The wplegalpages plugin before 1.1 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=legal-pages lp-domain-name, lp-business-name, lp-phone, lp-street, lp-city-state, lp-country, lp-email, lp-address, or lp-niche parameters.

Affected products

• Wplegalpages Wp Legal Pages: before 1.1 (fixed in 1.1)

Published 2019-09-26. Last modified 2026-06-17.