CVE-2021-24586CWE-352CWE-79

Per Page Add to Head < 1.4.4 - CSRF to Stored XSS

published September 13, 2021

CVSS
—
EPSS
0%
Percentile
40.7
In the wild
Unconfirmed
What it is

The Per page add to head WordPress plugin before 1.4.4 is lacking any CSRF check when saving its settings, which could allow attackers to make a logged in admin change them. Furthermore, as the plugin allows arbitrary HTML to be inserted in one of the setting (feature mentioned by the plugin), this could lead to Stored XSS issue which will be triggered either in the backend, frontend or both depending on the payload used.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00483 · 40.7th percentile
Weaknesses
CWE-352 · Cross-Site Request Forgery (CSRF); CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-09-13T17:56Z
EPSS history
Timeline
  • 13 SEP 17:56Z
    Per Page Add to Head < 1.4.4 - CSRF to Stored XSS
    cvelistv5