CVE-2021-24446

MEDIUM

Remove Footer Credit < 1.0.6 - Cross-Site Request Forgery and Stored Cross-Site Scripting

Title source: llm
STIX 2.1

Description

The Remove Footer Credit WordPress plugin before 1.0.6 does not have CSRF check in place when saving its settings, which could allow attacker to make logged in admins change them and lead to Stored XSS issue as well due to the lack of sanitisation

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/be55131b-d9f2-4ac1-b667-c544c066887f

Scores

CVSS v3 5.4
EPSS 0.0032
EPSS Percentile 24.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-352
Status published
Products (1)
wpchill/remove_footer_credit < 1.0.6
Published Feb 14, 2022
Tracked Since Feb 18, 2026