CVE-2021-24913

MEDIUM

Published Feb 28, 20224y ago · Modified Jun 17, 20262w ago

4.3 CVSS 3.1

Medium

Published Feb 28, 2022 4y ago

Last Modified Jun 17, 2026 2w ago

Description

The Logo Showcase with Slick Slider WordPress plugin before 2.0.1 does not have CSRF check in the lswss_save_attachment_data AJAX action, allowing attackers to make a logged in high privilege user, change title, description, alt text, and URL of arbitrary uploaded media.

CVSS Details

Base Score

4.3

Exploitability

2.8

Impact

1.4

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction Required

Scope Unchanged

Confidentiality None

Integrity Low

Availability None

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status

Public Exploit Known

No Patch Available

Weaknesses 1

CWE-352 Cross-Site Request Forgery (CSRF) Authentication

Affected Products 1

Vendor	Product	Version	Range
infornweb	logo_showcase_with_slick_slider	*	<2.0.1

References 2

plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/2669404

Release NotesThird Party Advisory
wpscan.com https://wpscan.com/vulnerability/2f499945-1924-49f0-ad6e-9192273a5c05

ExploitThird Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.