CVE-2021-4394

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Locations plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.1. This is due to missing or incorrect nonce validation on the saveCustomFields() function. This makes it possible for unauthenticated attackers to update custom field meta data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Jul 1, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-439407.8Affected versions of Atlassian Confluence Server and Data Center allow authenticated local attackers to achieve elevated privileges on the lCVE-2021-439416.5Affected versions of Atlassian Jira Server and Data Center allow remote attackers to modify several resources (including CsvFieldMappingsPagCVE-2021-439426.1Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected CroCVE-2021-439434.8Affected versions of Atlassian Jira Service Management Server and Data Center allow attackers with administrator privileges to inject arbitrCVE-2021-439447.2This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. AfCVE-2021-439454.8Affected versions of Atlassian Jira Server and Data Center allow remote attackers with Roadmaps Administrator permissions to inject arbitrarCVE-2021-439466.5Affected versions of Atlassian Jira Server and Data Center allow authenticated remote attackers to add administrator groups to filter subscrCVE-2021-439477.2Affected versions of Atlassian Jira Server and Data Center allow remote attackers with administrator privileges to execute arbitrary code viCVE-2021-439484.3Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view the names of privCVE-2021-439494.3Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view private objects vCVE-2021-43956.5The Abandoned Cart Recovery for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and includinCVE-2021-439504.3Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated remote attackers to view import source con
CVE-2021-4394: Medium severity, CVSS 4.3 | Vulnix