CVE Database /
CVE-2021-25106
CVE · Medium
CVE-2021-25106 — Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates – WPLP Legal Pages [wplegalpages] < 2.7.1
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2021-25106
|
Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates – WPLP Legal Pages [wplegalpages] < 2.7.1 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
5.4
|
< 2.7.1
|
2.7.1 |
2022-01-05 |
—
|
CVE-2021-25106
The WPLegalPages WordPress plugin prior to version 2.7.1 contains a critical vulnerability where authenticated users with minimal privileges, including subscribers, can modify plugin settings due to missing authorization checks and broken CSRF protection mechanisms. The plugin fails to properly sanitize and escape user input when saving these settings, which enables attackers to inject malicious scripts that persist in the database and execute for other users viewing the affected pages.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings