vulnerability
WordPress Plugin: wp-extra-file-types: CVE-2021-24936: Cross-Site Request Forgery (CSRF)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 6 | (AV:N/AC:M/Au:S/C:P/I:P/A:P) | Dec 27, 2021 | May 15, 2025 | May 15, 2025 |
Severity
6
CVSS
(AV:N/AC:M/Au:S/C:P/I:P/A:P)
Published
Dec 27, 2021
Added
May 15, 2025
Modified
May 15, 2025
Description
The WP Extra File Types WordPress plugin before 0.5.1 does not have CSRF check when saving its settings, nor sanitise and escape some of them, which could allow attackers to make a logged in admin change them and perform Cross-Site Scripting attacks
Solution
wp-extra-file-types-plugin-cve-2021-24936
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.