PT-2021-16110 · WordPress · Wp Cookie Choice

Dc11 · Published 2021-10-18 · Updated 2022-11-09 · CVE-2021-24595

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Wp Cookie Choice WordPress plugin versions 1.1.0 and earlier

Description The issue is related to the lack of CSRF checks when saving options and the failure to escape output in attributes. This allows an attacker to make a logged-in admin change options to arbitrary values, including XSS payloads, via a CSRF attack.

Recommendations For Wp Cookie Choice WordPress plugin versions 1.1.0 and earlier, update to a version that includes a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

CSRF

Weakness Enumeration

CWE-79

CWE-352

Related Identifiers

CVE-2021-24595

Affected Products

Wp Cookie Choice

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-24595 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24595 · Vendor Advisory
• https://t.me/cvenotify/33900 · Telegram Post
• https://wpscan.com/vulnerability/c809bdb3-d820-4ce1-9cbc-e41985fb5052 · Note