CVE-2021-24586
Per Page Add to Head < 1.4.4 - CSRF to Stored XSS
Vexday Risk Score
3Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS —EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
13 Sep 2021Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
The Per page add to head WordPress plugin before 1.4.4 is lacking any CSRF check when saving its settings, which could allow attackers to make a logged in admin change them. Furthermore, as the plugin allows arbitrary HTML to be inserted in one of the setting (feature mentioned by the plugin), this could lead to Stored XSS issue which will be triggered either in the backend, frontend or both depending on the payload used.
Affected products
Unknown · Per page add to headWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →