Vulnerability · Published Sep 13, 2021 · Assigned by WPScan

CVE-2021-24586Per Page Add to Head < 1.4.4 - CSRF to Stored XSS

Medium 4.3

In plain English

A medium-severity cross-site request forgery in Per page add to head from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS NVD)4.3Medium

Exploit odds (30 days)0.5%top 58.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The Per page add to head WordPress plugin before 1.4.4 is lacking any CSRF check when saving its settings, which could allow attackers to make a logged in admin change them. Furthermore, as the plugin allows arbitrary HTML to be inserted in one of the setting (feature mentioned by the plugin), this could lead to Stored XSS issue which will be triggered either in the backend, frontend or both depending on the payload used.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Per page add to head	1.4.4 – before 1.4.4

Weakness: CWE-352, CWE-79

References

https://wpscan.com/vulnerability/e9885fba-0e73-41a0-9e1d-47badc09be85 x_refsource_MISC