CVE-2021-24487

 

Published at: - 25-10-2021 04:15

Last modified: - 29-07-2022 12:15

Total changes: - 2

Description

The St-Daily-Tip WordPress plugin through 4.7 does not have any CSRF check in place when saving its 'Default Text to Display if no tips' setting, and was also lacking sanitisation as well as escaping before outputting it the page. This could allow attacker to make logged in administrators set a malicious payload in it, leading to a Stored Cross-Site Scripting issue

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://wpscan.com/vulnerability/def352f8-1bbe-4263-ad1a-1486140269f4

 

Keywords

NVD

 

CVE-2021-24487

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures