1. Home
  2. CVE Database
  3. CVE-2021-25014
LOW · 3.5

CVE-2021-25014

The Ibtana WordPress plugin before 1.1.4.9 does not have authorisation and CSRF checks in the ive_save_general_settings AJAX action, allowing any authenticated users, such as subscriber to call it and...

Vulnerability Description

The Ibtana WordPress plugin before 1.1.4.9 does not have authorisation and CSRF checks in the ive_save_general_settings AJAX action, allowing any authenticated users, such as subscriber to call it and change the plugin's settings which could lead to Stored Cross-Site Scripting issue.

CVSS Score

3.5

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
NONE
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
VowelwebIbtana< 1.1.4.9

Related Weaknesses (CWE)

CWE-862

References

FAQ

What is CVE-2021-25014?

CVE-2021-25014 is a vulnerability with a CVSS score of 3.5 (LOW). The Ibtana WordPress plugin before 1.1.4.9 does not have authorisation and CSRF checks in the ive_save_general_settings AJAX action, allowing any authenticated users, such as subscriber to call it and...

How severe is CVE-2021-25014?

CVE-2021-25014 has been rated LOW with a CVSS base score of 3.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-25014?

Check the references section above for vendor advisories and patch information. Affected products include: Vowelweb Ibtana.