CVE-2021-24801

MEDIUM

WP Survey Plus < 1.0 - Unauthenticated Survey Manipulation and Stored Cross-Site Scripting

Title source: llm
STIX 2.1

Description

The WP Survey Plus WordPress plugin through 1.0 does not have any authorisation and CSRF checks in place in its AJAX actions, allowing any user to call them and add/edit/delete Surveys. Furthermore, due to the lack of sanitization in the Surveys' Title, this could also lead to Stored Cross-Site Scripting issues

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/78405609-2105-4011-b18e-1ba5f438972d

Scores

CVSS v3 4.3
EPSS 0.0043
EPSS Percentile 34.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Details

CWE
CWE-284 CWE-352 CWE-79
Status published
Products (1)
wp_survey_plus_project/wp_survey_plus < 1.0
Published Nov 08, 2021
Tracked Since Feb 18, 2026