CVE-2021-24218

Katalog CVE

CVSS 8.8 · High EPSS 0,70%

Kerentanan Cross-Site Request Forgery (CSRF) pada facebook. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

The wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_settings AJAX actions of the Facebook for WordPress plugin before 3.0.4 were vulnerable to CSRF due to a lack of nonce protection. The settings in the saveFbeSettings function had no sanitization allowing for script tags to be saved.

Rincian

Terbit di NVD

12 April 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-352: Cross-Site Request Forgery (CSRF)

EPSS (30 hari)

0,70% peluang dieksploitasi; lebih tinggi dari 51,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://wpscan.com/vulnerability/169d21fc-d191-46ff-82e8-9ac887aed8a4 exploit · advisory pihak ketiga
• https://www.wordfence.com/blog/2021/03/two-vulnerabilities-patched-in-facebook-for-wordpress-plugin/ exploit · advisory pihak ketiga