CVE-2021-24685CWE-352CWE-79

Flat Preloader < 1.5.4 - CSRF to Stored Cross-Site Scripting

published November 1, 2021

CVSS
—
EPSS
1%
Percentile
42.4
In the wild
Unconfirmed
What it is

The Flat Preloader WordPress plugin before 1.5.4 does not enforce nonce checks when saving its settings, as well as does not sanitise and escape them, which could allow attackers to a make logged in admin change them with a Cross-Site Scripting payload (triggered either in the frontend or backend depending on the payload)

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00507 · 42.4th percentile
Weaknesses
CWE-352 · Cross-Site Request Forgery (CSRF); CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-11-01T08:46Z
EPSS history
Timeline
  • 01 NOV 08:46Z
    Flat Preloader < 1.5.4 - CSRF to Stored Cross-Site Scripting
    cvelistv5