« Volver al listado

CVE-2021-24487

Estado: ModificadaAlta (8.8)—

El plugin St-Daily-Tip de WordPress versiones hasta 4.7, no presenta ninguna comprobación de CSRF cuando guarda su configuración de "Default Text to Display if no tips", y también carece de saneo, así como de escape antes de la salida de la página. Esto podría permitir a un atacante hacer que los administradores conectados establezcan una carga útil maliciosa en ella, conllevando a un problema de tipo Cross-Site Scripting Almacenado

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Sanskruti — St-daily-tip

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-24487",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "contact@wpscan.com",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "St-Daily-Tip",
          "versions": [
            {
              "status": "affected",
              "version": "4.7",
              "versionType": "custom",
              "lessThanOrEqual": "4.7"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-10-25T14:15:10.093",
  "references": [
    {
      "url": "https://wpscan.com/vulnerability/def352f8-1bbe-4263-ad1a-1486140269f4",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "contact@wpscan.com"
    },
    {
      "url": "https://wpscan.com/vulnerability/def352f8-1bbe-4263-ad1a-1486140269f4",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "contact@wpscan.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The St-Daily-Tip WordPress plugin through 4.7 does not have any CSRF check in place when saving its 'Default Text to Display if no tips' setting, and was also lacking sanitisation as well as escaping before outputting it the page. This could allow attacker to make logged in administrators set a malicious payload in it, leading to a Stored Cross-Site Scripting issue"
    },
    {
      "lang": "es",
      "value": "El plugin St-Daily-Tip de WordPress versiones hasta 4.7, no presenta ninguna comprobación de CSRF cuando guarda su configuración de \"Default Text to Display if no tips\", y también carece de saneo, así como de escape antes de la salida de la página. Esto podría permitir a un atacante hacer que los administradores conectados establezcan una carga útil maliciosa en ella, conllevando a un problema de tipo Cross-Site Scripting Almacenado"
    }
  ],
  "lastModified": "2026-06-17T03:40:07.090",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sanskruti:st-daily-tip:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D5771427-8CA0-47AC-91A5-F60234B6A798",
              "versionEndIncluding": "4.7"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "contact@wpscan.com"
}