CVE-2021-25075CWE-862

Duplicate Page or Post < 1.5.1 - Arbitrary Settings Update to Stored XSS

published February 21, 2022

CVSS
—
EPSS
1%
Percentile
71.5
In the wild
Unconfirmed
What it is

The Duplicate Page or Post WordPress plugin before 1.5.1 does not have any authorisation and has a flawed CSRF check in the wpdevart_duplicate_post_parametrs_save_in_db AJAX action, allowing any authenticated users, such as subscriber to call it and change the plugin's settings, or perform such attack via CSRF. Furthermore, due to the lack of escaping, this could lead to Stored Cross-Site Scripting issues

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01359 · 71.5th percentile
Weakness
CWE-862 · Missing Authorization
Published
2022-02-21T10:45Z
EPSS history
Timeline
  • 21 FEB 10:45Z
    Duplicate Page or Post < 1.5.1 - Arbitrary Settings Update to Stored XSS
    cvelistv5