Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2021-24218

Facebook for WordPress 3.0.0-3.0.3 - CSRF to Stored XSS and Settings Deletion

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_settings AJAX actions of the Facebook for WordPress plugin before 3.0.4 were vulnerable to CSRF due to a lack of nonce protection. The settings in the saveFbeSettings function had no sanitization allowing for script tags to be saved.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown Facebook for WordPress

  • 3.0.0 to < 3.0.0*affected
  • 3.0.4 to < 3.0.4affected

References