CVE-2021-24446

The Remove Footer Credit WordPress plugin before 1.0.6 does not have CSRF check in place when saving its settings, which could allow attacker to make logged in admins change them and lead to Stored XSS issue as well due to the lack of sanitisation

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

6.0 MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P

EPSS

0.33% chance of exploitation in the next 30 days, 25th percentile

Published

2022-02-14

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/be55131b-d9f2-4ac1-b667-c544c066887f

References

• CVE Record
• NVD entry

Related

• CVE-2021-24445
• CVE-2021-24447
• CVE-2021-24444
• CVE-2021-24448
• CVE-2021-24443
• CVE-2021-24450