Lucene search
WPScanCVELIST:CVE-2021-25106HistoryFeb 07, 2022 - 3:47 p.m.
CVE-2021-25106 WPLegalPages < 2.7.1 - Subscriber+ Arbitrary Settings Update to Stored XSS
2022-02-0715:47:23
CWE-79
WPScan
www.cve.org
4
wplegalpages wordpress plugin
cve-2021-25106
stored cross-site scripting
EPSS
0.001
Percentile
21.1%
The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages WordPress plugin before 2.7.1 does not check for authorisation and has a flawed CSRF logic when saving its settings, allowing any authenticated users, such as subscriber, to update them. Furthermore, due to the lack of sanitisation and escaping, it could lead to Stored Cross-Site Scripting
CNA Affected
[
{
"product": "Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages",
"vendor": "Unknown",
"versions": [
{
"lessThan": "2.7.1",
"status": "affected",
"version": "2.7.1",
"versionType": "custom"
}
]
}
]Related
prion
prion
Cross site scripting
2022-02-07 16:15:00
wpvulndb
wpvulndb
WPLegalPages < 2.7.1 - Subscriber+ Arbitrary Settings Update to Stored XSS
2022-01-05 00:00:00
patchstack
patchstack
wpexploit
wpexploit
WPLegalPages < 2.7.1 - Subscriber+ Arbitrary Settings Update to Stored XSS
2022-01-05 00:00:00
nvd
nvd
CVE-2021-25106
2022-02-07 16:15:45
cve
cve
CVE-2021-25106
2022-02-07 16:15:45