1. Home
  2. CVE Database
  3. CVE-2021-24801
MEDIUM · 4.3

CVE-2021-24801

The WP Survey Plus WordPress plugin through 1.0 does not have any authorisation and CSRF checks in place in its AJAX actions, allowing any user to call them and add/edit/delete Surveys. Furthermore, d...

Vulnerability Description

The WP Survey Plus WordPress plugin through 1.0 does not have any authorisation and CSRF checks in place in its AJAX actions, allowing any user to call them and add/edit/delete Surveys. Furthermore, due to the lack of sanitization in the Surveys' Title, this could also lead to Stored Cross-Site Scripting issues

CVSS Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
NONE
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
Wp Survey Plus ProjectWp Survey Plus<= 1.0

Related Weaknesses (CWE)

CWE-79CWE-284CWE-352

References

FAQ

What is CVE-2021-24801?

CVE-2021-24801 is a vulnerability with a CVSS score of 4.3 (MEDIUM). The WP Survey Plus WordPress plugin through 1.0 does not have any authorisation and CSRF checks in place in its AJAX actions, allowing any user to call them and add/edit/delete Surveys. Furthermore, d...

How severe is CVE-2021-24801?

CVE-2021-24801 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-24801?

Check the references section above for vendor advisories and patch information. Affected products include: Wp Survey Plus Project Wp Survey Plus.