Skip to content
Sign in
4.3 Medium

CVE-2021-4397 The Staff Directory Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and…

Description

The Staff Directory Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.6. This is due to missing or incorrect nonce validation on the saveCustomFields() function. This makes it possible for unauthenticated attackers to save custom fields via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Affected products and versions

Product Affected versions Fixed in
Staff Directory Plugin: Company Directory 3.6 earliest → 3.6 No fix stated

Other CVEs of Staff Directory Plugin: Company Directory

The 3 CVEs of Staff Directory Plugin: Company Directory →
CVE-2024-13839 The Staff Directory Plugin: Company Directory plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due… 6.1 Medium CVE-2025-25165 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in richardgabriel… 7.1 High
Track this CVE