CVE-2021-24565

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The Contact Form 7 Captcha WordPress plugin before 0.0.9 does not have any CSRF check in place when saving its settings, allowing attacker to make a logged in user with the manage_options change them. Furthermore, the settings are not escaped when output in attributes, leading to a Stored Cross-Site Scripting issue.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-79CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Aug 23, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-245668.8The WooCommerce Currency Switcher FOX WordPress plugin before 1.3.7 was vulnerable to LFI attacks via the "woocs" shortcode.CVE-2021-245675.4The Simple Post WordPress plugin through 1.1 does not sanitize user input when an authenticated user Text value, then it does not escape theCVE-2021-245685.4The AddToAny Share Buttons WordPress plugin before 1.7.46 does not sanitise its Sharing Header setting when outputting it in frontend pages,CVE-2021-245694.8The Cookie Notice & Compliance for GDPR / CCPA WordPress plugin before 2.1.2 does not escape the value of its Button Text setting when outpuCVE-2021-24575.3Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: Request Management & Workflow). The supported version CVE-2021-245704.3The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which internally are posts. TheCVE-2021-245715.4The HD Quiz WordPress plugin before 1.8.4 does not escape some of its Answers before outputting them in attribute when generating the Quiz, CVE-2021-245724.3The Accept Donations with PayPal WordPress plugin before 1.3.1 provides a function to create donation buttons which are internally stored asCVE-2021-245744.8The Simple Banner WordPress plugin before 2.10.4 does not sanitise and escape one of its settings, allowing high privilege users such as admCVE-2021-245758.8The School Management System – WPSchoolPress WordPress plugin before 2.1.10 does not properly sanitize or use prepared statements before usiCVE-2021-245765.4The Easy Accordion WordPress plugin before 2.0.22 does not properly sanitize inputs when adding new items to an accordion.CVE-2021-245775.4The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not properly sanitize inputs submitted by authenticated users when s
CVE-2021-24565: High severity, CVSS 8.8 | Vulnix