Vulnerability · Published Oct 25, 2021 · Assigned by WPScan
CVE-2021-24487St Daily Tip <= 4.7 - CSRF to Stored Cross-Site Scripting
High 8.8
In plain English
A high-severity cross-site request forgery in St-Daily-Tip from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).
Severity (CVSS NVD)8.8High
Exploit odds (30 days)0.6%top 49.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The St-Daily-Tip WordPress plugin through 4.7 does not have any CSRF check in place when saving its 'Default Text to Display if no tips' setting, and was also lacking sanitisation as well as escaping before outputting it the page. This could allow attacker to make logged in administrators set a malicious payload in it, leading to a Stored Cross-Site Scripting issue
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | St-Daily-Tip | 4.7 – through 4.7 |
Weakness: CWE-352, CWE-79