CVE-2021-24822
Last modified
CVE-2021-24822 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. The Stylish Cost Calculator WordPress plugin before 7.0.4 does not have any authorisation and CSRF checks on some of its AJAX actions (available to authenticated users), which could allow any authenticated users, such as subscriber to call them, and perform Stored Cross-Site Scripting attacks against logged in admin, as well as frontend users due to the lack of sanitisation and escaping in some parameters. EPSS estimates a 0.31% chance of exploitation in the next 30 days.
Description
The Stylish Cost Calculator WordPress plugin before 7.0.4 does not have any authorisation and CSRF checks on some of its AJAX actions (available to authenticated users), which could allow any authenticated users, such as subscriber to call them, and perform Stored Cross-Site Scripting attacks against logged in admin, as well as frontend users due to the lack of sanitisation and escaping in some parameters
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Stylishcostcalculator | Stylish Cost Calculator | < 7.0.4 |
References
- https://wpscan.com/vulnerability/db84a782-d4c8-4abf-99ea-ea672a9b806eExploit, Third Party Advisory
- https://wpscan.com/vulnerability/db84a782-d4c8-4abf-99ea-ea672a9b806eExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-24822?
How severe is CVE-2021-24822?
How do I fix CVE-2021-24822?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-24817The Ultimate NoFollow WordPress plugin through 1.4.8 does no…5.4
- CVE-2021-24818The WP Limits WordPress plugin through 1.0 does not have CSR…4.3
- CVE-2021-24819The Page/Post Content Shortcode WordPress plugin through 1.0…4.3
- CVE-2021-2482Vulnerability in the Oracle Payables product of Oracle E-Bus…8.1
- CVE-2021-24820The Cost Calculator WordPress plugin through 1.6 allows auth…6.5
- CVE-2021-24821The Cost Calculator WordPress plugin before 1.6 allows users…5.4
- CVE-2021-24823The Support Board WordPress plugin before 3.3.6 does not hav…8.1
- CVE-2021-24824The [field] shortcode included with the Custom Content Short…4.3
- CVE-2021-24825The Custom Content Shortcode WordPress plugin before 4.0.2 d…4.3
- CVE-2021-24826The Custom Content Shortcode WordPress plugin before 4.0.2 d…5.4
- CVE-2021-24827The Asgaros Forum WordPress plugin before 1.15.13 does not v…9.8
- CVE-2021-24828The Mortgage Calculator / Loan Calculator WordPress plugin b…5.4
Are you affected by CVE-2021-24822?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST