← CVE Intelligence

CVE-2021-24581

Blue Admin <= 21.06.01 - CSRF to Stored Cross-Site Scripting (XSS) PUBLISHED

Description (CNA)

The Blue Admin WordPress plugin through 21.06.01 does not sanitise or escape its "Logo Title" setting before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin does not have CSRF check in place when saving its settings, allowing the issue to be exploited via a CSRF attack.

Affected (CNA)

Vendor / productVersions
Unknown / Blue Adminaffected 21.06.01 through 21.06.01

CWE

CWE-352, CWE-79

References

ADP enrichment

CVE

No English description supplied.