CVE-2021-24328

The WP Login Security and History WordPress plugin through 1.0 did not have CSRF check when saving its settings, not any sanitisation or validation on them. This could allow attackers to make logged in administrators change the plugin's settings to arbitrary values, and set XSS payloads on them as well

• CWE-352
• CWE-79
• CWE-352

• https://m0ze.ru/exploit/csrf-wp-login-security-and-history-v1.0.htmlExploit, Third Party Advisory
• https://m0ze.ru/vulnerability/%5B2021-03-29%5D-%5BWordPress%5D-%5BCWE-352%5D-WP-Login-Security-and-History-WordPress-Plugin-v1.0.txt
• https://m0ze.ru/vulnerability/%5B2021-03-29%5D-%5BWordPress%5D-%5BCWE-79%5D-WP-Login-Security-and-History-WordPress-Plugin-v1.0.txtExploit, Third Party Advisory
• https://wpscan.com/vulnerability/eeb41d7b-8f9e-4a12-b65f-f310f08e4aceExploit, Third Party Advisory
• https://m0ze.ru/exploit/csrf-wp-login-security-and-history-v1.0.htmlExploit, Third Party Advisory
• https://m0ze.ru/vulnerability/%5B2021-03-29%5D-%5BWordPress%5D-%5BCWE-352%5D-WP-Login-Security-and-History-WordPress-Plugin-v1.0.txt
• https://m0ze.ru/vulnerability/%5B2021-03-29%5D-%5BWordPress%5D-%5BCWE-79%5D-WP-Login-Security-and-History-WordPress-Plugin-v1.0.txtExploit, Third Party Advisory
• https://wpscan.com/vulnerability/eeb41d7b-8f9e-4a12-b65f-f310f08e4aceExploit, Third Party Advisory

Published

Jun 1, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-24322The Database Backup for WordPress plugin before 2.4 did not …5.4
• CVE-2021-24323When taxes are enabled, the "Additional tax classes" field w…4.8
• CVE-2021-24324The 404 SEO Redirection WordPress plugin through 1.3 is lack…6.5
• CVE-2021-24325The tab parameter of the settings page of the 404 SEO Redire…6.1
• CVE-2021-24326The tab parameter of the settings page of the All 404 Redire…5.4
• CVE-2021-24327The SEO Redirection Plugin – 301 Redirect Manager WordPress …4.8
• CVE-2021-24329The WP Super Cache WordPress plugin before 1.7.3 did not pro…5.4
• CVE-2021-2433Vulnerability in the Essbase Analytic Provider Services prod…7.5
• CVE-2021-24330The Funnel Builder by CartFlows – Create High Converting Sal…4.8
• CVE-2021-24331The Smooth Scroll Page Up/Down Buttons WordPress plugin befo…4.8
• CVE-2021-24332The Autoptimize WordPress plugin before 2.8.4 was missing pr…4.8
• CVE-2021-24333The Content Copy Protection & Prevent Image Save WordPress p…6.5