CVE-2021-24936 WP Extra File Types < 0.5.1 - CSRF to Stored Cross-Site Scripting

2022-01-2408:00:56

CWE-352

WPScan

www.cve.org

7.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

32.2%

JSON

The WP Extra File Types WordPress plugin before 0.5.1 does not have CSRF check when saving its settings, nor sanitise and escape some of them, which could allow attackers to make a logged in admin change them and perform Cross-Site Scripting attacks

CNA Affected

[
  {
    "product": "WP Extra File Types",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "0.5.1",
        "status": "affected",
        "version": "0.5.1",
        "versionType": "custom"
      }
    ]
  }
]