CVE-2021-4371

The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to Setting Changs in versions up to, and including, 5.5. This is due to lacking both a security nonce and a capabilities check. This makes it possible for low-authenticated attackers to change plugin settings even when they do not have the capabilities to do so.

• CWE-862
• CWE-862

• https://blog.nintechnet.com/multiple-vulnerabilities-in-wordpress-wp-quick-frontend-editor-plugin-unpatched/Exploit
• https://wordpress.org/plugins/wp-quick-front-end-editor/#developersProduct
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c392750b-ae4a-48b5-9ccb-43852fb13e27?source=cveThird Party Advisory
• https://blog.nintechnet.com/multiple-vulnerabilities-in-wordpress-wp-quick-frontend-editor-plugin-unpatched/Exploit
• https://wordpress.org/plugins/wp-quick-front-end-editor/#developersProduct
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c392750b-ae4a-48b5-9ccb-43852fb13e27?source=cveThird Party Advisory

Published

Jun 7, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43700An issue was discovered in ApiManager 1.1. there is sql inje…9.8
• CVE-2021-43701CSZ CMS 1.2.9 has a Time and Boolean-based Blind SQL Injecti…6.5
• CVE-2021-43702ASUS RT-A88U 3.0.0.4.386_45898 is vulnerable to Cross Site S…9
• CVE-2021-43703An Incorrect Access Control vulnerability exists in zzcms le…9.8
• CVE-2021-43707Cross Site Scripting (XSS) vulnerability exists in Maccms v1…6.1
• CVE-2021-43708The Labeling tool in Titus Classification Suite 18.8.1910.14…5.5
• CVE-2021-43711The downloadFlile.cgi binary file in TOTOLINK EX200 V4.0.3c.…9.8
• CVE-2021-43712Stored XSS in Add New Employee Form in Sourcecodester Employ…5.4
• CVE-2021-4372The WooCommerce Dynamic Pricing and Discounts plugin for Wor…6.1
• CVE-2021-43721Leanote 2.7.0 is vulnerable to Cross Site Scripting (XSS) in…6.1
• CVE-2021-43722D-Link DIR-645 1.03 A1 is vulnerable to Buffer Overflow. The…9.8
• CVE-2021-43724A Cross Site Scripting (XSS) vulnerability exits in Subrion …4.8