CVE-2021-36877: falha de média gravidade em StylemixThemes uListing (WordPress plugin)
WordPress uListing plugin <= 2.0.5 - Modify User Roles via Cross-Site Request Forgery (CSRF) vulnerability
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.3epss 0.4%
Cross-Site Request Forgery (CSRF) vulnerability in WordPress uListing plugin (versions <= 2.0.5) makes it possible for attackers to modify user roles.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Produtos afetados
StylemixThemes · uListing (WordPress plugin)CVEs relacionadas — StylemixThemes uListing (WordPress plugin)
No mesmo produto, das mais perigosas para as menos.
CVE-2021-36879CRITICALWordPress uListing plugin <= 2.0.5 - Unauthenticated Privilege Escalation vulnerabilityEPSS 2.2%CVE-2021-36880HIGHWordPress uListing plugin <= 2.0.3 - Unauthenticated SQL Injection (SQLi) vulnerabilityEPSS 2.1%CVE-2021-36874HIGHWordPress uListing plugin <= 2.0.5 - Authenticated Insecure Direct Object References (IDOR) vulnerabilityEPSS 1.1%CVE-2021-36876MEDIUMWordPress uListing plugin <= 2.0.5 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilitiesEPSS 0.4%CVE-2021-36878MEDIUMWordPress uListing plugin <= 2.0.5 - Settings Update via Cross-Site Request Forgery (CSRF) vulnerabilityEPSS 0.4%