CVE-2021-24324CWE-352

404 SEO Redirection <= 1.3 - CSRF to Stored Cross-Site Scripting (XSS)

published May 17, 2021

CVSS
—
EPSS
1%
Percentile
45.9
In the wild
Unconfirmed
What it is

The 404 SEO Redirection WordPress plugin through 1.3 is lacking CSRF checks in all its settings, allowing attackers to make a logged in user change the plugin's settings. Due to the lack of sanitisation and escaping in some fields, it could also lead to Stored Cross-Site Scripting issues

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00560 · 45.9th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2021-05-17T16:48Z
EPSS history
Timeline
  • 17 MAY 16:48Z
    404 SEO Redirection <= 1.3 - CSRF to Stored Cross-Site Scripting (XSS)
    cvelistv5