CVE-2021-24685

The Flat Preloader WordPress plugin before 1.5.4 does not enforce nonce checks when saving its settings, as well as does not sanitise and escape them, which could allow attackers to a make logged in admin change them with a Cross-Site Scripting payload (triggered either in the frontend or backend depending on the payload)

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N

EPSS

0.51% chance of exploitation in the next 30 days, 41th percentile

Published

2021-11-01

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/972ecde8-3d44-4dd9-81e3-643d8737434f

References

• CVE Record
• NVD entry

Related

• CVE-2021-24684
• CVE-2021-24686
• CVE-2021-24683
• CVE-2021-24687
• CVE-2021-24682
• CVE-2021-24688