CVE-2021-4383

HIGH

WP Quick FrontEnd Editor < 5.5 - Authenticated Page Content Injection via Missing Capability Checks

Title source: llm
STIX 2.1

Description

The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to page content injection in versions up to, and including, 5.5. This is due to missing capability checks in the plugin's page-editing functionality. This makes it possible for low-authenticated attackers, such as subscribers, to edit/create any page or post on the blog.

References (3)

Core 3

Scores

CVSS v3 8.1
EPSS 0.0080
EPSS Percentile 52.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (2)
labibahmed42/WP Quick FrontEnd Editor – WordPress Plugin < 5.5
webdevocean/wp_quick_frontend_editor < 5.5
Published Jun 07, 2023
Tracked Since Feb 18, 2026