CVE-2021-24380

PoC —

CVSS 3.1

4.3 medium

EPSS

<1%p38

Published

Aug 16, 2021 (Aug 16, 2021)

Modified

Jun 17, 2026

Description

The Shantz WordPress QOTD WordPress plugin through 1.2.2 is lacking any CSRF check when updating its settings, allowing attackers to make logged in administrators change them to arbitrary values.

Vendors: shantz wordpress qotd project
Products: shantz wordpress qotd
Ecosystems: WordPress
Weakness: CWE-352
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.