CVE-2021-24477CWE-352CWE-79

Migrate Users <= 1.0.1 - CSRF to Stored Cross-Site Scripting (XSS)

published August 2, 2021

CVSS
—
EPSS
0%
Percentile
34.4
In the wild
Unconfirmed
What it is

The Migrate Users WordPress plugin through 1.0.1 does not sanitise or escape its Delimiter option before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin does not have CSRF check in place when saving its options, allowing the issue to be exploited via a CSRF attack.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00412 · 34.4th percentile
Weaknesses
CWE-352 · Cross-Site Request Forgery (CSRF); CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-08-02T10:32Z
EPSS history
Timeline
  • 02 AUG 10:32Z
    Migrate Users <= 1.0.1 - CSRF to Stored Cross-Site Scripting (XSS)
    cvelistv5