Not rated
CVE-2021-24958 The Meks Easy Photo Feed Widget WordPress plugin before 1.2.4 does not have capability and CSRF checks in the…
Description
The Meks Easy Photo Feed Widget WordPress plugin before 1.2.4 does not have capability and CSRF checks in the meks_save_business_selected_account AJAX action, available to any authenticated user, and does not escape some of the settings. As a result, any authenticated user, such as subscriber could update the plugin's settings and put Cross-Site Scripting payloads in them
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Meks Easy Photo Feed Widget 1.2 | earliest → < 1.2.4 | 1.2.4 |