1. Home
  2. CVE Database
  3. CVE-2021-24431
MEDIUM · 4.3

CVE-2021-24431

The Language Bar Flags WordPress plugin through 1.0.8 does not have any CSRF in place when saving its settings and did not sanitise or escape them when generating the flag bar in the frontend. This co...

Vulnerability Description

The Language Bar Flags WordPress plugin through 1.0.8 does not have any CSRF in place when saving its settings and did not sanitise or escape them when generating the flag bar in the frontend. This could allow attackers to make a logged in admin change the settings, and set Cross-Site Scripting payload in them, which will be executed in the frontend for all users

CVSS Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
NONE
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
Language Bar Flags ProjectLanguage Bar Flags<= 1.0.8

Related Weaknesses (CWE)

CWE-79CWE-352

References

FAQ

What is CVE-2021-24431?

CVE-2021-24431 is a vulnerability with a CVSS score of 4.3 (MEDIUM). The Language Bar Flags WordPress plugin through 1.0.8 does not have any CSRF in place when saving its settings and did not sanitise or escape them when generating the flag bar in the frontend. This co...

How severe is CVE-2021-24431?

CVE-2021-24431 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-24431?

Check the references section above for vendor advisories and patch information. Affected products include: Language Bar Flags Project Language Bar Flags.