Vulnerability · Published Oct 25, 2021 · Assigned by WPScan
CVE-2021-24543jQuery Reply to Comment <= 1.31 - CSRF to Stored Cross-Site Scripting
Medium 6.1
In plain English
A medium-severity cross-site request forgery in jQuery Reply to Comment from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).
Severity (CVSS NVD)6.1Medium
Exploit odds (30 days)0.4%top 64.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The jQuery Reply to Comment WordPress plugin through 1.31 does not have any CSRF check when saving its settings, nor sanitise or escape its 'Quote String' and 'Reply String' settings before outputting them in Comments, leading to a Stored Cross-Site Scripting issue.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | jQuery Reply to Comment | 1.31 – through 1.31 |
Weakness: CWE-352, CWE-79