1. Home
  2. CVE Database
  3. CVE-2021-24792
MEDIUM · 6.1

CVE-2021-24792

The Shiny Buttons WordPress plugin through 1.1.0 does not have any authorisation and CSRF in place when saving a template (wpbtn_save_template function hooked to the init action), nor sanitise and esc...

Vulnerability Description

The Shiny Buttons WordPress plugin through 1.1.0 does not have any authorisation and CSRF in place when saving a template (wpbtn_save_template function hooked to the init action), nor sanitise and escape them before outputting them in the admin dashboard, which allow unauthenticated users to add a malicious template and lead to Stored Cross-Site Scripting issues.

CVSS Score

6.1

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
WpedenShiny Buttons<= 1.1.0

Related Weaknesses (CWE)

CWE-79

References

FAQ

What is CVE-2021-24792?

CVE-2021-24792 is a vulnerability with a CVSS score of 6.1 (MEDIUM). The Shiny Buttons WordPress plugin through 1.1.0 does not have any authorisation and CSRF in place when saving a template (wpbtn_save_template function hooked to the init action), nor sanitise and esc...

How severe is CVE-2021-24792?

CVE-2021-24792 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-24792?

Check the references section above for vendor advisories and patch information. Affected products include: Wpeden Shiny Buttons.