CVE-2021-24988: unknown wp rss aggregator – news feeds, autoblogging, youtube video feeds and more Cross-Site Request Forgery (CSRF)

Vulnerability summary

CVE-2021-24988 is a medium (CVSS 5.4) Cross-Site Request Forgery (CSRF) vulnerability in unknown wp rss aggregator – news feeds, autoblogging, youtube video feeds and more. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 27-12-2021
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

The WP RSS Aggregator WordPress plugin before 4.19.3 does not sanitise and escape data before outputting it in the System Info admin dashboard, which could lead to a Stored XSS issue due to the wprss_dismiss_addon_notice AJAX action missing authorisation and CSRF checks, allowing any authenticated users, such as subscriber to call it and set a malicious payload in the addon parameter.

• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
• CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.