CVE-2021-24328

Katalog CVE

CVSS 6.2 · Medium EPSS 0,61%

Kerentanan Cross-Site Request Forgery (CSRF) pada clogica wp login security and history. Skor CVSS 3.1 6.2 (Medium) menurut NVD.

Deskripsi (NVD)

The WP Login Security and History WordPress plugin through 1.0 did not have CSRF check when saving its settings, not any sanitisation or validation on them. This could allow attackers to make logged in administrators change the plugin's settings to arbitrary values, and set XSS payloads on them as well

Rincian

Terbit di NVD

1 Juni 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.2 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-352: Cross-Site Request Forgery (CSRF)
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,61% peluang dieksploitasi; lebih tinggi dari 48,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://m0ze.ru/exploit/csrf-wp-login-security-and-history-v1.0.html exploit · advisory pihak ketiga
• https://m0ze.ru/vulnerability/%5B2021-03-29%5D-%5BWordPress%5D-%5BCWE-79%5D-WP-Login-Security-and-History-Word... exploit · advisory pihak ketiga
• https://wpscan.com/vulnerability/eeb41d7b-8f9e-4a12-b65f-f310f08e4ace exploit · advisory pihak ketiga
• https://m0ze.ru/vulnerability/%5B2021-03-29%5D-%5BWordPress%5D-%5BCWE-352%5D-WP-Login-Security-and-History-Wor...