CVE-2021-24936
High
Description
The WP Extra File Types WordPress plugin before 0.5.1 does not have CSRF check when saving its settings, nor sanitise and escape some of them, which could allow attackers to make a logged in admin change them and perform Cross-Site Scripting attacks
SeverityHigh
CVSS8.0
Exploit probability—
ProductWp Extra File Types
PublishedJan 24, 2022
First seenJan 24, 2022
Weakness typeCWE-352Cross-site request forgery (CSRF)
How to fix
Update
- wp_extra_file_types_project wp_extra_file_types0.5.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wp_extra_file_types_project wp_extra_file_types | v < 0.5.1 | 0.5.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.