CVE-2021-24328
WP Login Security and History <= 1.0 - CSRF to Stored Cross-Site Scripting (XSS)
MEDIUM 6.2EPSS 0.6%
The WP Login Security and History WordPress plugin through 1.0 did not have CSRF check when saving its settings, not any sanitisation or validation on them. This could allow attackers to make logged in administrators change the plugin's settings to arbitrary values, and set XSS payloads on them as well
- Affected
- WP Login Security and History
- CVSS v3.1 NVD
- 6.2 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:N - CVSS v2.0 NVD
- 3.5 LOW
AV:N/AC:M/Au:S/C:N/I:P/A:N - EPSS
- 0.61% chance of exploitation in the next 30 days, 48th percentile
- Published
- 2021-06-01
- Updated
- 2024-08-03
Proof-of-concept exploits (3)
- https://m0ze.ru/exploit/csrf-wp-login-security-and-history-v1.0.html
- https://m0ze.ru/vulnerability/%5B2021-03-29%5D-%5BWordPress%5D-%5BCWE-79%5D-WP-Login-Secu…
- https://wpscan.com/vulnerability/eeb41d7b-8f9e-4a12-b65f-f310f08e4ace