CVE-2021-24328
MEDIUMWP Login Security and History < 1.0 - Cross-Site Request Forgery and Stored Cross-Site Scripting
Title source: llmDescription
The WP Login Security and History WordPress plugin through 1.0 did not have CSRF check when saving its settings, not any sanitisation or validation on them. This could allow attackers to make logged in administrators change the plugin's settings to arbitrary values, and set XSS payloads on them as well
References (4)
Core 4
Core References
Exploit, Third Party Advisory x_refsource_confirm
https://wpscan.com/vulnerability/eeb41d7b-8f9e-4a12-b65f-f310f08e4ace
Exploit, Third Party Advisory x_refsource_misc
https://m0ze.ru/exploit/csrf-wp-login-security-and-history-v1.0.html
Various Sources x_refsource_misc
https://m0ze.ru/vulnerability/%5B2021-03-29%5D-%5BWordPress%5D-%5BCWE-352%5D-WP-Login-Security-and-History-WordPress-Plugin-v1.0.txt
Exploit, Third Party Advisory x_refsource_misc
https://m0ze.ru/vulnerability/%5B2021-03-29%5D-%5BWordPress%5D-%5BCWE-79%5D-WP-Login-Security-and-History-WordPress-Plugin-v1.0.txt
Scores
CVSS v3
6.2
EPSS
0.0061
EPSS Percentile
45.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:N
Details
CWE
CWE-352
CWE-79
Status
published
Products (1)
clogica/wp_login_security_and_history
< 1.0
Published
Jun 01, 2021
Tracked Since
Feb 18, 2026