CVE-2021-4394

The Locations plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.1. This is due to missing or incorrect nonce validation on the saveCustomFields() function. This makes it possible for unauthenticated attackers to update custom field meta data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/Not Applicable
• https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/Exploit, Technical Description, Third Party Advisory
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/Not Applicable
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2548546%40locations&new=2548546%40locations&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/3df9f237-a861-43fc-8623-d42f84d8d5d1?source=cveThird Party Advisory
• https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/Not Applicable
• https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/Exploit, Technical Description, Third Party Advisory
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/Not Applicable
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2548546%40locations&new=2548546%40locations&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/3df9f237-a861-43fc-8623-d42f84d8d5d1?source=cveThird Party Advisory

Published

Jul 1, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43934Elcomplus SmartPTT is vulnerable as the backup and restore s…9.8
• CVE-2021-43935The impacted products, when configured to use SSO, are affec…9.8
• CVE-2021-43936The software allows the attacker to upload or transfer files…9.8
• CVE-2021-43937Elcomplus SmartPTT SCADA Server web application does not, or…8.8
• CVE-2021-43938Elcomplus SmartPTT SCADA Server is vulnerable to an unauthen…9.8
• CVE-2021-43939Elcomplus SmartPTT is vulnerable when a low-authenticated us…8.8
• CVE-2021-43940Affected versions of Atlassian Confluence Server and Data Ce…7.8
• CVE-2021-43941Affected versions of Atlassian Jira Server and Data Center a…6.5
• CVE-2021-43942Affected versions of Atlassian Jira Server and Data Center a…6.1
• CVE-2021-43943Affected versions of Atlassian Jira Service Management Serve…4.8
• CVE-2021-43944This issue exists to document that a security improvement in…7.2
• CVE-2021-43945Affected versions of Atlassian Jira Server and Data Center a…4.8