VULNERABILITY INTELLIGENCE

CVE-2021-24328

CVSS score6.2 MEDIUM
EPSS probability0.61%
CISA KEVNot currently listed
Published2021-06-01
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:N

Description

The WP Login Security and History WordPress plugin through 1.0 did not have CSRF check when saving its settings, not any sanitisation or validation on them. This could allow attackers to make logged in administrators change the plugin's settings to arbitrary values, and set XSS payloads on them as well

Weakness classification

  • contact@wpscan.com: CWE-352
  • nvd@nist.gov: CWE-79

Primary references