Keywords & Meta <= 3.0 - CSRF to Stored Cross-Site Scripting (XSS)
Vulnerability Description
The Keyword Meta WordPress plugin through 3.0 does not sanitise of escape its settings before outputting them back in the page after they are saved, allowing for Cross-Site Scripting issues. Furthermore, it is also lacking any CSRF check, allowing attacker to make a logged in high privilege user save arbitrary setting via a CSRF attack.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-24611
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Genubhau wayal
More from Unknown
View All →Affected Vendor
Unknown
View all reports →