VULNERABILITY INTELLIGENCE

CVE-2021-24685

CVSS score5.4 MEDIUM
EPSS probability0.51%
CISA KEVNot currently listed
Published2021-11-01
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Description

The Flat Preloader WordPress plugin before 1.5.4 does not enforce nonce checks when saving its settings, as well as does not sanitise and escape them, which could allow attackers to a make logged in admin change them with a Cross-Site Scripting payload (triggered either in the frontend or backend depending on the payload)

Weakness classification

  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
  • CWE-352: Cross-Site Request Forgery (CSRF)

Primary references