1. Home
  2. CVE Database
  3. CVE-2021-25010
CRITICAL · 9.6

CVE-2021-25010

The Post Snippets WordPress plugin before 3.1.4 does not have CSRF check when importing files, allowing attacker to make a logged In admin import arbitrary snippets. Furthermore, imported snippers are...

Vulnerability Description

The Post Snippets WordPress plugin before 3.1.4 does not have CSRF check when importing files, allowing attacker to make a logged In admin import arbitrary snippets. Furthermore, imported snippers are not sanitised and escaped, which could lead to Stored Cross-Site Scripting issues

CVSS Score

9.6

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
PostsnippetsPost Snippets< 3.1.4

Related Weaknesses (CWE)

CWE-352

References

FAQ

What is CVE-2021-25010?

CVE-2021-25010 is a vulnerability with a CVSS score of 9.6 (CRITICAL). The Post Snippets WordPress plugin before 3.1.4 does not have CSRF check when importing files, allowing attacker to make a logged In admin import arbitrary snippets. Furthermore, imported snippers are...

How severe is CVE-2021-25010?

CVE-2021-25010 has been rated CRITICAL with a CVSS base score of 9.6/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2021-25010?

Check the references section above for vendor advisories and patch information. Affected products include: Postsnippets Post Snippets.