CVE-2021-24466CWE-352CWE-79

Verse-O-Matic <= 4.1.1 - CSRF to Stored XSS

published August 16, 2021

CVSS
—
EPSS
0%
Percentile
34.4
In the wild
Unconfirmed
What it is

The Verse-O-Matic WordPress plugin through 4.1.1 does not have any CSRF checks in place, allowing attackers to make logged in administrators do unwanted actions, such as add/edit/delete arbitrary verses and change the settings. Due to the lack of sanitisation in the settings and verses, this could also lead to Stored Cross-Site Scripting issues

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00412 · 34.4th percentile
Weaknesses
CWE-352 · Cross-Site Request Forgery (CSRF); CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-08-16T10:48Z
EPSS history
Timeline
  • 16 AUG 10:48Z
    Verse-O-Matic <= 4.1.1 - CSRF to Stored XSS
    cvelistv5