Vulnerability Description
The Per page add to head WordPress plugin before 1.4.4 is lacking any CSRF check when saving its settings, which could allow attackers to make a logged in admin change them. Furthermore, as the plugin allows arbitrary HTML to be inserted in one of the setting (feature mentioned by the plugin), this could lead to Stored XSS issue which will be triggered either in the backend, frontend or both depending on the payload used.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Evona | Per Page Add To Head | < 1.4.4 |
Related Weaknesses (CWE)
References
- https://wpscan.com/vulnerability/e9885fba-0e73-41a0-9e1d-47badc09be85ExploitThird Party Advisory
- https://wpscan.com/vulnerability/e9885fba-0e73-41a0-9e1d-47badc09be85ExploitThird Party Advisory
FAQ
What is CVE-2021-24586?
CVE-2021-24586 is a vulnerability with a CVSS score of 4.3 (MEDIUM). The Per page add to head WordPress plugin before 1.4.4 is lacking any CSRF check when saving its settings, which could allow attackers to make a logged in admin change them. Furthermore, as the plugin...
How severe is CVE-2021-24586?
CVE-2021-24586 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-24586?
Check the references section above for vendor advisories and patch information. Affected products include: Evona Per Page Add To Head.