CVE-2021-24763

Perfect Survey < 1.5.2 - Unauthorised AJAX Call to Stored XSS / Survey Settings Update

published February 1, 2022

CVSS
—
EPSS
1%
Percentile
50.3
In the wild
Unconfirmed
What it is

The Perfect Survey WordPress plugin before 1.5.2 does not have proper authorisation nor CSRF checks in the save_global_setting AJAX action, allowing unauthenticated users to edit surveys and modify settings. Given the lack of sanitisation and escaping in the settings, this could also lead to a Stored Cross-Site Scripting issue which will be executed in the context of a user viewing any survey

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00644 · 50.3th percentile
Published
2022-02-01T12:21Z
EPSS history
Timeline
  • 01 FEB 12:21Z
    Perfect Survey < 1.5.2 - Unauthorised AJAX Call to Stored XSS / Survey Settings Update
    cvelistv5