CVE-2021-24431
Language Bar Flags <= 1.0.8 - CSRF to Stored XSS
- State
- Published
- Severity
- Not scored
- Published
- Sep 13, 2021
- Updated
- Aug 3, 2024
- Reserved
- Jan 14, 2021
Description
The Language Bar Flags WordPress plugin through 1.0.8 does not have any CSRF in place when saving its settings and did not sanitise or escape them when generating the flag bar in the frontend. This could allow attackers to make a logged in admin change the settings, and set Cross-Site Scripting payload in them, which will be executed in the frontend for all users
Scores
The record has no CVSS score.
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Language Bar FlagsUnknown |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.