CVE-2021-24159

Katalog CVE

CVSS 8.8 · High EPSS 0,59%

Kerentanan Cross-Site Request Forgery (CSRF) pada rocklobster contact form 7. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Due to the lack of sanitization and lack of nonce protection on the custom CSS feature, an attacker could craft a request to inject malicious JavaScript on a site using the Contact Form 7 Style WordPress plugin through 3.1.9. If an attacker successfully tricked a site’s administrator into clicking a link or attachment, then the request could be sent and the CSS settings would be successfully updated to include malicious JavaScript.

Rincian

Terbit di NVD

5 April 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-352: Cross-Site Request Forgery (CSRF)

EPSS (30 hari)

0,59% peluang dieksploitasi; lebih tinggi dari 46,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://wpscan.com/vulnerability/363182f1-9fda-4363-8f6a-be37c4c07aa9 advisory pihak ketiga
• https://www.wordfence.com/blog/2021/02/unpatched-vulnerability-50000-wp-sites-must-find-alternative-for-contac... advisory pihak ketiga