CVE-2021-4333

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The WP Statistics plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 13.1.1. This is due to missing or incorrect nonce validation on the view() function. This makes it possible for unauthenticated attackers to activate and deactivate arbitrary plugins, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Mar 7, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-433316.1In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS.CVE-2021-433326.5In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. T CVE-2021-433336.5The Datalogic DXU service on (for example) DL-Axist devices does not require authentication for configuration changes or disclosure of confi CVE-2021-433345.4BuddyBoss Platform through 1.8.0 allows XSS via the Group Name or Group Description field.CVE-2021-433367.8An Out-of-Bounds Write vulnerability exists when reading a DXF or DWG file using Open Design Alliance Drawings SDK before 2022.11. The speci CVE-2021-433376.5SchedMD Slurm 21.08.* before 21.08.4 has Incorrect Access Control. On sites using the new AccountingStoreFlags=job_script and/or job_env opt CVE-2021-433398.8In Ericsson Network Location before 2021-07-31, it is possible for an authenticated attacker to inject commands via file_name in the export CVE-2021-43348.8The Fancy Product Designer plugin for WordPress is vulnerable to unauthorized modification of site options due to a missing capability check CVE-2021-43356.3The Fancy Product Designer plugin for WordPress is vulnerable to unauthorized access to data and modification of plugin settings due to a mi CVE-2021-433509.8An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint CVE-2021-433538.8The Crisp Live Chat WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the crisp_plugin_settin CVE-2021-433559.8Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 allows user input to be validated on the client side without au