CVE-2021-24801

The WP Survey Plus WordPress plugin through 1.0 does not have any authorisation and CSRF checks in place in its AJAX actions, allowing any user to call them and add/edit/delete Surveys. Furthermore, due to the lack of sanitization in the Surveys' Title, this could also lead to Stored Cross-Site Scripting issues

CVSS v3.1

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

0.45% chance of exploitation in the next 30 days, 38th percentile

Published

2021-11-08

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/78405609-2105-4011-b18e-1ba5f438972d

References

• CVE Record
• NVD entry

Related

• CVE-2021-24800
• CVE-2021-24802
• CVE-2021-24799
• CVE-2021-24803
• CVE-2021-24798
• CVE-2021-24804