CVE-2021-24642CWE-352CWE-79

Scroll Baner <= 1.0 - CSRF to RCE

published October 18, 2021

CVSS
—
EPSS
1%
Percentile
46.5
In the wild
Unconfirmed
What it is

The Scroll Baner WordPress plugin through 1.0 does not have CSRF check in place when saving its settings, nor perform any sanitisation, escaping or validation on them. This could allow attackers to make logged in admin change them and could lead to RCE (via a file upload) as well as XSS

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00572 · 46.5th percentile
Weaknesses
CWE-352 · Cross-Site Request Forgery (CSRF); CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-10-18T13:45Z
EPSS history
Timeline
  • 18 OCT 13:45Z
    Scroll Baner <= 1.0 - CSRF to RCE
    cvelistv5