CVE-2021-4389

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The WP Travel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.4.6. This is due to missing or incorrect nonce validation on the save_meta_data() function. This makes it possible for unauthenticated attackers to save metadata for travel posts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Jul 1, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-438907.1We have investigated reports of a spoofing vulnerability in AppX installer that affects Microsoft Windows. Microsoft is aware of attacks thaCVE-2021-438917.8Visual Studio Code Remote Code Execution VulnerabilityCVE-2021-438927.4Microsoft BizTalk ESB Toolkit Spoofing VulnerabilityCVE-2021-438937.5Windows Encrypting File System (EFS) Elevation of Privilege VulnerabilityCVE-2021-438965.5Microsoft PowerShell Spoofing VulnerabilityCVE-2021-438999.8Microsoft 4K Wireless Display Adapter Remote Code Execution VulnerabilityCVE-2021-43904.3The Contact Form 7 Style plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2. This is dueCVE-2021-439059.6Microsoft Office app Remote Code Execution VulnerabilityCVE-2021-439079.8Visual Studio Code WSL Extension Remote Code Execution VulnerabilityCVE-2021-439084.3Visual Studio Code Spoofing VulnerabilityCVE-2021-43914.3The Ultimate Gift Cards for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2CVE-2021-43924.3The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and i
CVE-2021-4389: Medium severity, CVSS 4.3 | Vulnix