CVE-2021-25060 Five Star Business Profile and Schema < 2.1.7 - Subscriber+ Page Creation & Settings Update to Stored XSS

The Five Star Business Profile and Schema WordPress plugin before 2.1.7 does not have any authorisation and CSRF in its bpfwpwelcomeaddcontactpage and bpfwpwelcomesetcontactinformation AJAX action, allowing any authenticated users, such as subscribers, to call them. Furthermore, due to the lack o...

CVE-2021-25060

CVE-2021-25060 affects the WordPress plugin Five Star Business Profile and Schema (versions before 2.1.7). The issue arises from missing authorization and CSRF checks on the AJAX actions bpfwp_welcome_add_contact_page and bpfwp_welcome_set_contact_information, allowing any authenticated user (e.g...