CVE-2021-24446 Remove Footer Credit < 1.0.6 - CSRF to Stored Cross-Site Scripting

2022-02-1409:20:32

CWE-352

WPScan

www.cve.org

cve-2021-24446

wordpress plugin

cross-site scripting

csrf

stored xss

security vulnerability

EPSS

0.001

Percentile

21.2%

JSON

The Remove Footer Credit WordPress plugin before 1.0.6 does not have CSRF check in place when saving its settings, which could allow attacker to make logged in admins change them and lead to Stored XSS issue as well due to the lack of sanitisation

CNA Affected

[
  {
    "product": "Remove Footer Credit",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.0.6",
        "status": "affected",
        "version": "1.0.6",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/be55131b-d9f2-4ac1-b667-c544c066887f

EPSS

0.001

Percentile

21.2%

JSON

Related for CVELIST:CVE-2021-24446