CVE-2021-24870 WP Fastest Cache < 0.9.5 - CSRF to Stored Cross-Site Scripting
Attackers can inject malicious scripts via CSRF in WP Fastest Cache, potentially compromising high-privilege user accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-24870?
CVE-2021-24870 is a medium-severity cross-site scripting vulnerability in Unknown WP Fastest Cache, published on 16 Jan 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The WP Fastest Cache WordPress plugin before 0.9.5 is lacking a CSRF check in its wpfc_save_cdn_integration AJAX action, and does not sanitise and escape some the options available via the action, which could allow attackers to make logged in high privilege users call it and set a Cross-Site Scripting payload
Weakness: CWE-352
Which versions are affected by CVE-2021-24870?
It affects 1 product.
Products include Wpfastestcache Wp Fastest Cache.
How do I fix CVE-2021-24870?
No fix has been published for CVE-2021-24870 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-24870 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-24870 exists.
Other vulnerabilities in Unknown WP Fastest Cache
Sources
Also known as GHSA-mvrw-4465-r2jc.