404 SEO Redirection <= 1.3 - CSRF to Stored Cross-Site Scripting (XSS)
CVE-2021-24324

6.5MEDIUM

Key Information:

Vendor
Wordpress
Status
404 Seo Redirection
Vendor
CVE Published:
17 May 2021

Summary

The 404 SEO Redirection WordPress plugin through 1.3 is lacking CSRF checks in all its settings, allowing attackers to make a logged in user change the plugin's settings. Due to the lack of sanitisation and escaping in some fields, it could also lead to Stored Cross-Site Scripting issues

Affected Version(s)

404 SEO Redirection 1.3

References

https://wpscan.com/vulnerability/63a24890-3735-4016-b4b7-...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

m0ze
.