CVE-2021-24434CWE-352CWE-79

Glass <= 1.3.2 - CSRF to Stored Cross-Site Scripting (XSS)

published July 12, 2021

CVSS
—
EPSS
0%
Percentile
34.4
In the wild
Unconfirmed
What it is

The Glass WordPress plugin through 1.3.2 does not sanitise or escape its "Glass Pages" setting before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin did not have CSRF check in place when saving its settings, allowing the issue to be exploited via a CSRF attack.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00412 · 34.4th percentile
Weaknesses
CWE-352 · Cross-Site Request Forgery (CSRF); CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-07-12T19:21Z
EPSS history
Timeline
  • 12 JUL 19:21Z
    Glass <= 1.3.2 - CSRF to Stored Cross-Site Scripting (XSS)
    cvelistv5