CVE-2021-24581CWE-352CWE-79

Blue Admin <= 21.06.01 - CSRF to Stored Cross-Site Scripting (XSS)

published August 30, 2021

CVSS
—
EPSS
4%
Percentile
90.7
In the wild
Unconfirmed
What it is

The Blue Admin WordPress plugin through 21.06.01 does not sanitise or escape its "Logo Title" setting before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin does not have CSRF check in place when saving its settings, allowing the issue to be exploited via a CSRF attack.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04087 · 90.7th percentile
Weaknesses
CWE-352 · Cross-Site Request Forgery (CSRF); CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-08-30T14:11Z
EPSS history
Timeline
  • 30 AUG 14:11Z
    Blue Admin <= 21.06.01 - CSRF to Stored Cross-Site Scripting (XSS)
    cvelistv5