CVE-2021-24565

creationtimestamp| type| source ---|---|--- 2021-08-23 16:23:14+00:00| seen| https://t.me/cibsecurity/27695...

CVE-2021-24565

The Contact Form 7 Captcha WordPress plugin before 0.0.9 does not have any CSRF check in place when saving its settings, allowing attacker to make a logged in user with the manageoptions change them. Furthermore, the settings are not escaped when output in attributes, leading to a Stored Cross-Si...

CVE-2021-24565 Contact Form 7 Captcha < 0.0.9 - CSRF to Stored XSS

The Contact Form 7 Captcha WordPress plugin before 0.0.9 does not have any CSRF check in place when saving its settings, allowing attacker to make a logged in user with the manageoptions change them. Furthermore, the settings are not escaped when output in attributes, leading to a Stored Cross-Si...

CVE-2021-24565

CVE-2021-24565 concerns the WordPress plugin Contact Form 7 Captcha (versions before 0.0.9). The vulnerability combines a CSRF weakness in the settings save flow with a Stored XSS risk caused by unescaped output in attributes. An attacker who has a logged-in user with the manage_options capabilit...