CVE-2021-24870 WP Fastest Cache < 0.9.5 - CSRF to Stored Cross-Site Scripting

2024-01-1615:49:40

WPScan

www.cve.org

cve-2021-24870

wordpress plugin

csrf

stored cross-site scripting

security vulnerability

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

17.0%

JSON

The WP Fastest Cache WordPress plugin before 0.9.5 is lacking a CSRF check in its wpfc_save_cdn_integration AJAX action, and does not sanitise and escape some the options available via the action, which could allow attackers to make logged in high privilege users call it and set a Cross-Site Scripting payload

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "WP Fastest Cache",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "0.9.5"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]