CVE-2021-24611 Keywords & Meta <= 3.0 - CSRF to Stored Cross-Site Scripting (XSS)

The Keyword Meta WordPress plugin through 3.0 does not sanitise of escape its settings before outputting them back in the page after they are saved, allowing for Cross-Site Scripting issues. Furthermore, it is also lacking any CSRF check, allowing attacker to make a logged in high privilege user...

CVE-2021-24611

The CVE-2021-24611 entry concerns the WordPress Keyword Meta plugin (versions up to 3.0). Affected component is the plugin’s settings output, which is not sanitized/escaped before being echoed, enabling Cross‑Site Scripting (XSS). The issue is compounded by a lack of CSRF protection, allowing a l...