CVE-2021-24611CWE-352CWE-79

Keywords & Meta <= 3.0 - CSRF to Stored Cross-Site Scripting (XSS)

published September 6, 2021

CVSS
—
EPSS
0%
Percentile
23.6
In the wild
Unconfirmed
What it is

The Keyword Meta WordPress plugin through 3.0 does not sanitise of escape its settings before outputting them back in the page after they are saved, allowing for Cross-Site Scripting issues. Furthermore, it is also lacking any CSRF check, allowing attacker to make a logged in high privilege user save arbitrary setting via a CSRF attack.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00319 · 23.6th percentile
Weaknesses
CWE-352 · Cross-Site Request Forgery (CSRF); CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-09-06T11:09Z
EPSS history
Timeline
  • 06 SEP 11:09Z
    Keywords & Meta <= 3.0 - CSRF to Stored Cross-Site Scripting (XSS)
    cvelistv5