{"id":"CVE-2021-24936","state":"PUBLISHED","title":"WP Extra File Types < 0.5.1 - CSRF to Stored Cross-Site Scripting","description":"The WP Extra File Types WordPress plugin before 0.5.1 does not have CSRF check when saving its settings, nor sanitise and escape some of them, which could allow attackers to make a logged in admin change them and perform Cross-Site Scripting attacks","publishedAt":"2022-01-24T08:00:56.000Z","updatedAt":"2024-08-03T19:49:13.407Z","severity":null,"assigner":"WPScan","products":["Unknown WP Extra File Types"],"affected":[{"vendor":"Unknown","product":"WP Extra File Types","versions":[{"version":"0.5.1","status":"affected","lessThan":"0.5.1","versionType":"custom"}]}],"references":["https://wpscan.com/vulnerability/4fb61b84-ff5f-4b4c-a516-54b749f9611e"],"weaknesses":["CWE-352"],"ingestedAt":"2026-10-29T19:48:07.505Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/24xxx/CVE-2021-24936.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2021-24936","state":"PUBLISHED","datePublished":"2022-01-24T08:00:56.000Z","dateUpdated":"2024-08-03T19:49:13.407Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2021-01-14T00:00:00.000Z"},"containers":{"cna":{"title":"WP Extra File Types < 0.5.1 - CSRF to Stored Cross-Site Scripting","descriptions":[{"lang":"en","value":"The WP Extra File Types WordPress plugin before 0.5.1 does not have CSRF check when saving its settings, nor sanitise and escape some of them, which could allow attackers to make a logged in admin change them and perform Cross-Site Scripting attacks"}],"affected":[{"vendor":"Unknown","product":"WP Extra File Types","versions":[{"version":"0.5.1","status":"affected","lessThan":"0.5.1","versionType":"custom"}]}],"references":[{"url":"https://wpscan.com/vulnerability/4fb61b84-ff5f-4b4c-a516-54b749f9611e","tags":["x_refsource_MISC"]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-352","description":"CWE-352 Cross-Site Request Forgery (CSRF)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","dateUpdated":"2022-01-24T08:00:56.000Z","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81"},"credits":[{"lang":"en","value":"JrXnm"}],"source":{"discovery":"EXTERNAL"},"x_generator":"WPScan CVE Generator","x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"contact@wpscan.com","ID":"CVE-2021-24936","STATE":"PUBLIC","TITLE":"WP Extra File Types < 0.5.1 - CSRF to Stored Cross-Site Scripting"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"WP Extra File Types","version":{"version_data":[{"version_affected":"<","version_name":"0.5.1","version_value":"0.5.1"}]}}]},"vendor_name":"Unknown"}]}},"credit":[{"lang":"eng","value":"JrXnm"}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The WP Extra File Types WordPress plugin before 0.5.1 does not have CSRF check when saving its settings, nor sanitise and escape some of them, which could allow attackers to make a logged in admin change them and perform Cross-Site Scripting attacks"}]},"generator":"WPScan CVE Generator","problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-352 Cross-Site Request Forgery (CSRF)"}]}]},"references":{"reference_data":[{"name":"https://wpscan.com/vulnerability/4fb61b84-ff5f-4b4c-a516-54b749f9611e","refsource":"MISC","url":"https://wpscan.com/vulnerability/4fb61b84-ff5f-4b4c-a516-54b749f9611e"}]},"source":{"discovery":"EXTERNAL"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://wpscan.com/vulnerability/4fb61b84-ff5f-4b4c-a516-54b749f9611e","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T19:49:13.407Z"}}]}}}