CVE-2021-24595 — WP Cookie Choice <= 1.1.0 - CSRF to Stored Cross-Site Scripting
The Wp Cookie Choice WordPress plugin through 1.1.0 is lacking any CSRF check when saving its options, and do not escape them when outputting them in attributes. As a result, an…
Published: 2021-10-18 · CVSS: Unscored
The Wp Cookie Choice WordPress plugin through 1.1.0 is lacking any CSRF check when saving its options, and do not escape them when outputting them in attributes. As a result, an attacker could make a logged in admin change them to arbitrary values including XSS payloads via a CSRF attack.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7