CVE-2021-24446 Remove Footer Credit < 1.0.6 - CSRF to Stored Cross-Site Scripting

2022-02-1409:20:32

CWE-352

WPScan

www.cve.org

0.001 Low

EPSS

Percentile

21.3%

JSON

The Remove Footer Credit WordPress plugin before 1.0.6 does not have CSRF check in place when saving its settings, which could allow attacker to make logged in admins change them and lead to Stored XSS issue as well due to the lack of sanitisation

CNA Affected

[
  {
    "product": "Remove Footer Credit",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.0.6",
        "status": "affected",
        "version": "1.0.6",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/be55131b-d9f2-4ac1-b667-c544c066887f

0.001 Low

EPSS

Percentile

21.3%

JSON

Related for CVELIST:CVE-2021-24446