CVE-2021-25106CWE-79

WPLegalPages < 2.7.1 - Subscriber+ Arbitrary Settings Update to Stored XSS

published February 7, 2022

CVSS
—
EPSS
1%
Percentile
48.0
In the wild
Unconfirmed
What it is

The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages WordPress plugin before 2.7.1 does not check for authorisation and has a flawed CSRF logic when saving its settings, allowing any authenticated users, such as subscriber, to update them. Furthermore, due to the lack of sanitisation and escaping, it could lead to Stored Cross-Site Scripting

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00600 · 48.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-02-07T15:47Z
EPSS history
Timeline
  • 07 FEB 15:47Z
    WPLegalPages < 2.7.1 - Subscriber+ Arbitrary Settings Update to Stored XSS
    cvelistv5