{"id":"CVE-2021-24411","state":"PUBLISHED","title":"Social Tape <= 1.0 - CSRF to Stored XSS","description":"The Social Tape WordPress plugin through 1.0 does not have CSRF checks in place when saving its settings, and do not sanitise or escape them before outputting them back in the page, leading to a stored Cross-Site Scripting issue via a CSRF attack","publishedAt":"2021-08-16T10:48:19.000Z","updatedAt":"2024-08-03T19:28:23.811Z","severity":null,"assigner":"WPScan","products":["Unknown Social Tape"],"affected":[{"vendor":"Unknown","product":"Social Tape","versions":[{"version":"1.0","status":"affected","lessThanOrEqual":"1.0","versionType":"custom"}]}],"references":["https://wpscan.com/vulnerability/ebe7f625-67e1-4df5-a569-20526dd57b24"],"weaknesses":["CWE-79","CWE-352"],"ingestedAt":"2026-10-29T19:48:07.505Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/24xxx/CVE-2021-24411.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2021-24411","state":"PUBLISHED","datePublished":"2021-08-16T10:48:19.000Z","dateUpdated":"2024-08-03T19:28:23.811Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2021-01-14T00:00:00.000Z"},"containers":{"cna":{"title":"Social Tape <= 1.0 - CSRF to Stored XSS","descriptions":[{"lang":"en","value":"The Social Tape WordPress plugin through 1.0 does not have CSRF checks in place when saving its settings, and do not sanitise or escape them before outputting them back in the page, leading to a stored Cross-Site Scripting issue via a CSRF attack"}],"affected":[{"vendor":"Unknown","product":"Social Tape","versions":[{"version":"1.0","status":"affected","lessThanOrEqual":"1.0","versionType":"custom"}]}],"references":[{"url":"https://wpscan.com/vulnerability/ebe7f625-67e1-4df5-a569-20526dd57b24","tags":["x_refsource_MISC"]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Cross-site Scripting (XSS)","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-352","description":"CWE-352 Cross-Site Request Forgery (CSRF)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","dateUpdated":"2021-08-16T10:48:19.000Z","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81"},"credits":[{"lang":"en","value":"Ashish Upsham"}],"source":{"discovery":"UNKNOWN"},"x_generator":"WPScan CVE Generator","x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"contact@wpscan.com","ID":"CVE-2021-24411","STATE":"PUBLIC","TITLE":"Social Tape <= 1.0 - CSRF to Stored XSS"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Social Tape","version":{"version_data":[{"version_affected":"<=","version_name":"1.0","version_value":"1.0"}]}}]},"vendor_name":"Unknown"}]}},"credit":[{"lang":"eng","value":"Ashish Upsham"}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The Social Tape WordPress plugin through 1.0 does not have CSRF checks in place when saving its settings, and do not sanitise or escape them before outputting them back in the page, leading to a stored Cross-Site Scripting issue via a CSRF attack"}]},"generator":"WPScan CVE Generator","problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-79 Cross-site Scripting (XSS)"}]},{"description":[{"lang":"eng","value":"CWE-352 Cross-Site Request Forgery (CSRF)"}]}]},"references":{"reference_data":[{"name":"https://wpscan.com/vulnerability/ebe7f625-67e1-4df5-a569-20526dd57b24","refsource":"MISC","url":"https://wpscan.com/vulnerability/ebe7f625-67e1-4df5-a569-20526dd57b24"}]},"source":{"discovery":"UNKNOWN"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://wpscan.com/vulnerability/ebe7f625-67e1-4df5-a569-20526dd57b24","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T19:28:23.811Z"}}]}}}