Medium severity · published Feb 14, 2022
CVE-2021-24446
The Remove Footer Credit WordPress plugin before 1.0.6 does not have CSRF check in place when saving its settings, which could allow attacker to make logged in admins change them…
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
The Remove Footer Credit WordPress plugin before 1.0.6 does not have CSRF check in place when saving its settings, which could allow attacker to make logged in admins change them and lead to Stored XSS issue as well due to the lack of sanitisation
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RF
Remove Footer Credit · Wpchill
before 1.0.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-24446
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-24446
Exploit
https://wpscan.com/vulnerability/be55131b-d9f2-4ac1-b667-c544c066887f
More from Remove Footer Credit
4.8
CVE-2024-32429
WordPress Remove Footer Credit plugin <= 1.0.13 - Cross Site Scripting (XSS) vulnerability
4.8
CVE-2021-25050
The Remove Footer Credit WordPress plugin before 1.0.11 does properly sanitise its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the…