CVE-2021-24586

 

Published at: - 13-09-2021 08:15

Last modified: - 29-07-2022 12:15

Total changes: - 5

Description

The Per page add to head WordPress plugin before 1.4.4 is lacking any CSRF check when saving its settings, which could allow attackers to make a logged in admin change them. Furthermore, as the plugin allows arbitrary HTML to be inserted in one of the setting (feature mentioned by the plugin), this could lead to Stored XSS issue which will be triggered either in the backend, frontend or both depending on the payload used.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

 

Verification logic

 

Reference

• https://wpscan.com/vulnerability/e9885fba-0e73-41a0-9e1d-47badc09be85

 

Keywords

NVD

 

CVE-2021-24586

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures