CVEvulnerability

CVE-2021-24801

4.3 MEDIUM Published 2021-11-08 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-11-08
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-284, CWE-352, CWE-79

Description

The WP Survey Plus WordPress plugin through 1.0 does not have any authorisation and CSRF checks in place in its AJAX actions, allowing any user to call them and add/edit/delete Surveys. Furthermore, due to the lack of sanitization in the Surveys' Title, this could also lead to Stored Cross-Site Scripting issues

Affected configurations

• wp survey plus project wp survey plus (<= 1.0)

Related

Weakness · CWE (3)

  • CWE-284 Improper Access Control weakness
  • CWE-352 Cross-Site Request Forgery weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References